A critical OS command injection vulnerability in Green-Computing NUMail allows unauthenticated remote attackers to achieve full system compromise.

This is an OS command injection flaw (CWE-78) occurring because the application fails to properly neutralize special elements within input data. An unauthenticated remote attacker can supply malicious input to execute arbitrary commands with the privileges of the NUMail service.

Successful exploitation of this vulnerability grants an attacker complete control over the affected server, leading to full system compromise. Given the CVSS score of 9.8, this represents a critical risk that could result in massive data exfiltration, service disruption, and the potential for lateral movement into the internal network.

Immediate Action: Update the Green-Computing NUMail instance to version 202602162 or later immediately to apply the vendor-supplied security patch.

Proactive Monitoring: Review application and system access logs for anomalous execution patterns or unexpected child processes originating from the NUMail service.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common OS command injection payloads, such as shell metacharacters, in inbound HTTP requests.

Public Exploit Available: Unknown

Due to the critical severity and the absence of authentication requirements, immediate patching is mandatory to secure the environment. Administrators should verify their current version and apply the update to version 202602162 as the highest priority task to eliminate the risk of remote command execution.