Vendor
Spug versions 3.4.0 and earlier are vulnerable to authenticated remote code execution due to improper shell command validation in the ping_check function.