This vulnerability involves improper neutralization of special elements used in OS commands (CWE-78) within Tenable Security Center. Specifically, unvalidated input in asset filter parameters permits shell metacharacters to escape intended command argument handling, leading to remote code execution as a low-privileged OS user through the Analysis REST endpoint. The CVSS 3.1 base score is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. There is no vendor-provided remediation or patch information available at this time, and no known exploits in the wild have been reported.

Successful exploitation allows an attacker to execute arbitrary OS commands remotely with low-privileged user rights, potentially compromising system confidentiality, integrity, and availability. The vulnerability affects the Analysis REST endpoint and could lead to full system compromise depending on the privileges of the affected user context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Analysis REST endpoint and validate or sanitize input parameters at the application or network level to mitigate exploitation risk.