BridgeHead FileStore versions prior to 24A expose Apache Axis2 administration module with default credentials on network-accessible endpoints. Unauthenticated remote attackers can exploit this vulnerability to execute arbitrary OS commands by authenticating to the admin console with default credentials, uploading malicious Java archives as web services, and executing commands via SOAP requests to the deployed service.