An OS command injection vulnerability exists in the CWMP SelfDefinedTimeZone functionality of Grandstream GXP2135 devices running firmware versions 1.0.9.129, 1.0.11.74, and 1.0.11.79. This flaw allows an attacker to send specially crafted network packets that can trigger arbitrary command execution on the affected device.