The affected products are missing authentication for a critical function, which could allow an attacker to run as root and pass received bytes directly to a system command.
CWE-306