This vulnerability involves command injection in Raynet rvia version 12.6.4392.49-amd64.deb. The issue arises from the improper termination of search criteria in the Java search feature, which uses the find command. An adversary can leverage this flaw by providing a specially crafted path that leads to arbitrary Java code execution. The vulnerability was published on May 27, 2026, but no CVSS score or remediation details have been provided.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary Java code on the affected system, potentially leading to unauthorized code execution and system compromise. However, no known exploits have been reported in the wild, and the extent of impact depends on the deployment context and privileges of the affected application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates. Applying general security best practices such as restricting access to the affected application and limiting privileges may reduce risk but do not specifically mitigate this vulnerability.