This vulnerability affects kylecui NetForensicMCP version 2.1.0 specifically in the execAsync function within index.js. An attacker can remotely manipulate the interface/protocol argument to inject and execute arbitrary commands on the affected system. The vulnerability has been publicly disclosed and exploit code is available, increasing the risk of exploitation. No official patch or remediation has been provided by the vendor as of the publication date.

Successful exploitation allows remote attackers to execute arbitrary commands on the system running NetForensicMCP 2.1.0, potentially leading to unauthorized control or disruption of the affected system. The CVSS 4.0 score of 5.3 reflects a medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed.

No official fix or patch is currently available from the vendor. Users should monitor the vendor's communications for updates. Until a patch is released, consider restricting network access to the affected service and applying compensating controls to limit exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.