The vulnerability is an OS command injection flaw (CWE-78) affecting the phMonitor service in FortiSIEM. The phMonitor service handles health monitoring, task distribution, and inter-node communication via TCP port 7900. The flaw involves two components: an unauthenticated argument injection vulnerability leading to arbitrary file write allowing remote code execution as admin user, and a file overwrite privilege escalation vulnerability leading to root access. The attack exploits how phMonitor handles requests related to logging security events to Elasticsearch, invoking shell scripts with user-controlled parameters. This enables argument injection via curl, achieving arbitrary file writes. Attackers can write a reverse shell to /opt/charting/redishb.sh, which is executed every minute by a root-level cron job, enabling privilege escalation from admin to root.