An unauthenticated OS command injection vulnerability (CWE-78) exists in the ping.php endpoint of TREXOM TrxTimeATTENDANCE. Remote attackers can exploit this flaw to execute arbitrary OS commands, resulting in remote code execution. The vulnerability affects versions >=1.0.5 and <1.9.6. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available.

Successful exploitation allows remote attackers to execute arbitrary operating system commands without authentication, leading to full remote code execution on affected systems. This compromises confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the vulnerable endpoint and monitor for suspicious activity targeting ping.php.