This vulnerability exists in the eval function within the VpsTest Console component of the 546669204 vps-inventory-monitoring product, specifically in the file app/index/command/VpsTest.php. By manipulating the 'vf' argument, an attacker can perform code injection remotely. The product's rolling release model means versioning details for affected or fixed releases are not available. The vendor has not issued a patch or official remediation guidance as of the publication date. The CVSS 4.0 score is 5.3, indicating medium severity with network attack vector, low complexity, and no user interaction required.

Successful exploitation allows remote code injection, potentially enabling attackers to execute arbitrary code on the affected system with limited privileges. This could lead to unauthorized actions depending on the environment and privileges of the vulnerable component. No confirmed active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should consider applying manual mitigations such as restricting access to the vulnerable component or disabling the affected functionality if feasible until an official fix is released.