A critical OS command injection vulnerability in elecV2P enables unauthenticated remote attackers to execute arbitrary code on the underlying host system.

The application fails to sanitize user input within the pm2run method of the /rpc endpoint before passing it to a system execution function. This flaw allows an unauthenticated remote attacker to inject and execute arbitrary OS commands with the privileges of the application process.

Successful exploitation of this vulnerability grants an attacker full control over the host running the elecV2P service. This can lead to total system compromise, unauthorized data exfiltration, lateral movement within the network, and complete service disruption. Given the CVSS score of 7.3 and the nature of command injection, the potential for severe impact on business operations and data integrity is high.

Immediate Action: As no official patch is currently available, administrators should immediately restrict network access to the /rpc endpoint or disable the elecV2P service until a security update is released by the vendor.

Proactive Monitoring: Review system and application logs for suspicious process execution patterns or unexpected requests directed at the /rpc endpoint, particularly those containing shell metacharacters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block requests targeting the /rpc endpoint or those attempting to inject shell commands into JSON parameters.

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the official project issue tracker.

This vulnerability presents a severe risk to organizational infrastructure due to the ease of remote command execution. Given the availability of public proof-of-concept code, attackers are likely to target exposed instances. Organizations must prioritize immediate isolation of the affected software and monitor for any signs of unauthorized system access until a vendor-supplied patch is successfully deployed.