This vulnerability exists in chenhg5 cc-connect up to version 1.4.1, specifically in the shellExecCommand function of core/engine.go within the Management API. Improper handling of the exec argument enables remote OS command injection, allowing attackers to execute arbitrary commands on the affected system. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity) with network attack vector, low complexity, no privileges or user interaction required, and limited impacts on confidentiality, integrity, and availability. Public exploit code is available, but no known active exploitation has been reported.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected system, potentially leading to unauthorized control or disruption. The impact is rated medium severity with limited confidentiality, integrity, and availability impacts as per the CVSS vector. There is no evidence of active exploitation in the wild.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Management API and monitor for suspicious activity related to command execution attempts. Avoid exposing vulnerable versions to untrusted networks.