netis-systems MEX605 v2.00.06 allows attackers to execute arbitrary OS commands via a crafted payload to the ping test page.
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')