The Image Scanner Driver for Linux (fi Series) by PFU Limited contains an OS command injection vulnerability due to improper neutralization of special elements used in OS commands. This flaw allows an attacker who can log in to the affected Linux system to execute arbitrary OS commands by preparing specific inputs. The vulnerability affects several versions including 2.0.0, 2.3.0, 2.3.2, 2.5.0, and ranges from 2.1.0 to 2.1.1 (including 2.1.1-4), 2.2.0 to 2.2.2, 2.7.0 to 2.7.1, and 2.8.0 to 2.8.2.

Successful exploitation allows an attacker with low privileges and login access to execute arbitrary OS commands, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. The CVSS vector indicates high impact on confidentiality, integrity, and availability, but requires local login with low privileges and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict login access to trusted users only and monitor for suspicious activity related to the scanner driver. Do not rely on generic mitigations as the vulnerability requires specific handling by the vendor.