IBM Aspera Faspex 5 versions 5.0.0 through 5.0.15.4 are affected by a command injection vulnerability stemming from unquoted shell interpolation. This flaw allows a remote attacker with authenticated access to execute arbitrary code on the affected system. The vulnerability is identified as CWE-78 and carries a CVSS 3.1 base score with critical severity. No patch or remediation information is provided in the available data, and no known exploits are reported in the wild at this time.

Successful exploitation of this vulnerability could lead to complete compromise of the affected system, including unauthorized code execution with the privileges of the authenticated user. This impacts confidentiality, integrity, and availability of the system and data handled by IBM Aspera Faspex 5 within the affected versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted users only and monitor for suspicious activity related to command execution. Avoid running the application with elevated privileges if possible to reduce impact.