Improper input validation in management control functions may allow a remote attacker with high privileges to inject operating system commands and execute them with root privileges.
CWE-78