In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument (lib/ui/api.ts and lib/ping.ts).
CVSS 3.1CRITICAL 9.8·Network·No auth·No interaction·EPSS 0.21901·Published 2022-03-06·Fixed in 1.2.8CWE-78