Joaquin Rodriguez Varela

The issue allows remote authenticated users to execute arbitrary OS commands. This is achieved by injecting shell metacharacters in the `mac` parameter of the snwrite.cgi endpoint.

The issue allows remote attackers to execute arbitrary OS commands via shell metacharacters after an "&" (ampersand) in the `write mac`, `write pid`, `write msn`, `write tan`, or `write hdv` parameter. This is due to the lack of measures to neutralize special elements used in the operating system command. Exploitation of the issue may allow a remote attacker to execute arbitrary OS commands using shell metacharacters.

The issue is caused by an integer signedness error in the `amd64 set ldt` function, located in `sys/amd64/amd64/sys machdep.c`, which leads to a heap-based buffer overflow. This can be exploited by a local attacker using the `i386 set ldt` system call, resulting in a denial of service (kernel panic).