This vulnerability involves unsafe use of the eval function in the VpsTest Console component of the 546669204 vps-inventory-monitoring product. By manipulating the vf argument passed to the vulnerable function, an attacker can perform remote code injection. The product is delivered via a rolling release model, complicating version tracking for affected or fixed releases. The vendor has been notified but has not yet responded or issued a fix. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low complexity, and no privileges or user interaction required.

Successful exploitation allows remote attackers to execute arbitrary code on the affected system, potentially compromising system integrity and confidentiality. Given the medium CVSS score and the nature of code injection, this could lead to unauthorized control or disruption of the affected service. However, there are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should consider applying manual code review and hardening measures to the vulnerable eval usage if possible. Monitoring for updates from the vendor is recommended to apply an official fix once available.