The affected product is vulnerable to two instances of command injection, which may allow an attacker to remotely execute arbitrary code.
CWE-77, NVD-CWE-Other