This vulnerability allows an unauthenticated attacker to achieve remote command execution on the affected PAM system by uploading a specially crafted PAM upgrade file.
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')