This vulnerability (CVE-2024-40089) affects Vilo 5 Mesh WiFi System firmware versions <= 5.16.1.33. Authenticated remote attackers can exploit a command injection flaw by inserting shell commands into the device name field, leading to arbitrary code execution. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, required high privileges, no user interaction, and complete compromise of confidentiality, integrity, and availability. No patch or official fix has been documented in the provided data.

Successful exploitation allows authenticated remote attackers to execute arbitrary commands on the device, potentially leading to full system compromise. This affects confidentiality, integrity, and availability of the affected Vilo 5 Mesh WiFi System devices. The vulnerability could enable attackers to control the device, disrupt network services, or pivot to other internal systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to device management interfaces to trusted users only and monitor for unusual activity. Avoid using device names that could be manipulated by untrusted users. Follow vendor channels for updates on patches or official mitigations.