This vulnerability in N-Media OrderConvo (up to version 12.4) is due to missing authorization controls, enabling unauthenticated attackers to execute arbitrary operating system commands via the affected component. The issue is classified under CWE-862 (Missing Authorization) and results in OS Command Injection. The CVSS 3.1 base score is 10.0, reflecting network attack vector, no required privileges or user interaction, and complete compromise of confidentiality, integrity, and availability. No patch or official remediation level has been published by the vendor as of the data provided.

Successful exploitation allows an unauthenticated attacker to execute arbitrary OS commands on the affected system, leading to full system compromise including complete loss of confidentiality, integrity, and availability of the affected application and potentially the host system. This represents a critical security risk for organizations using vulnerable versions of OrderConvo.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider restricting access to the vulnerable application to trusted networks only and monitor for any suspicious activity related to OrderConvo. Avoid exposing the affected service directly to untrusted networks.