This vulnerability in Japan Computer Emergency Response Team Coordination Center (JPCERT/CC) LogonTracer before version 2.0.0 is caused by improper neutralization of special elements used in OS commands, leading to OS command injection. A logged-in user can exploit this flaw to execute arbitrary OS commands, potentially compromising system confidentiality, integrity, and availability. The CVSS 3.0 vector indicates network attack vector, low attack complexity, required privileges of a logged-in user, no user interaction, and impacts all security properties highly. No vendor advisory or patch information is currently available, and the product is not a cloud service.

Successful exploitation allows a logged-in user to execute arbitrary OS commands, which can lead to full system compromise including unauthorized data access, modification, or denial of service. The CVSS score of 8.8 reflects a high impact on confidentiality, integrity, and availability. There are no known exploits in the wild, but the vulnerability presents a significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to trusted users only and consider additional monitoring or containment measures for systems running affected versions. Avoid exposing LogonTracer interfaces to untrusted networks or users.