Description

An authenticated command injection vulnerability was identified in GMS Command-Line Interface (CLI) 9.5.1 (Build 9510.1044) and earlier versions which allows low-privileged local user to execute system commands with root privileges.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-11T21:17:49.287Z",
  "pubdate": "2026-08-11T21:17:49.287Z",
  "executiveSummary": "An authenticated command injection vulnerability has been identified within the GMS Command-Line Interface (CLI) 9.5.1 (Build 9510.1044) and all preceding versions. This security flaw enables low-privileged local users to execute arbitrary system commands with elevated root privileges, bypassing intended security boundaries. The vulnerability poses a severe risk to confidentiality, integrity, and availability, as successful exploitation results in complete system compromise.\nThe attack vector requires local access and authentication, meaning an adversary must first provision or compromise a low-privileged account within the local environment before initiating the attack sequence. The root cause stems from improper neutralization of special elements used in command strings, allowing specially crafted user input to be directly interpreted and executed by the underlying operating system shell with maximum administrative privileges.",
  "technicalDetails": "The vulnerability resides in the GMS Command-Line Interface (CLI) 9.5.1 (Build 9510.1044) and earlier versions, specifically within components that process user-supplied parameters without adequate input sanitization or validation. The root cause is categorized as an improper neutralization of special elements in data, which manifests as a command injection vulnerability.\nExploitation of this flaw requires an attacker to possess authenticated local access to the affected system with low-privileged credentials. The attack flow begins when the user invokes specific vulnerable CLI functions and supplies maliciously crafted input strings containing command separators or shell metacharacters. Because the underlying application logic passes these unsanitized parameters directly to a system shell or execution sink with root privileges, the operating system evaluates the embedded commands and executes them outside of the intended application context.\nDuring payload behavior, the injected commands inherit the security context of the parent execution thread, which executes with root privileges. This grants the attacker the ability to execute arbitrary binaries, manipulate system configurations, access restricted files, install persistent backdoors, or compromise other users on the host system. Due to the lack of proper parameterization and input filtering within the vulnerable component, the execution flow is successfully hijacked by the injected command sequence, achieving horizontal and vertical privilege escalation."
}