CVE-2024-58314 is an authenticated OS command injection vulnerability affecting ATCOM Technology 100M IP Phones firmware version 2.7.x.x. The issue exists in the web configuration CGI script 'web_cgi_main.cgi', where the 'cmd' parameter is improperly neutralized, allowing attackers with administrative privileges to execute arbitrary system commands remotely. This vulnerability is classified under CWE-78 and has a CVSS 4.0 base score of 8.7, indicating high severity with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation allows an attacker with administrative credentials to execute arbitrary system commands on the affected device, potentially compromising the device's integrity and confidentiality. This could lead to full remote control of the IP phone system, affecting availability and security of communications. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is currently available, it is recommended to restrict administrative access to the web configuration interface to trusted users only and monitor for suspicious activity. Avoid exposing the management interface to untrusted networks until a fix is released.