CVE-2025-31710

The engineermode service fails to properly validate user input, allowing attackers to inject commands that execute with elevated privileges. This could let an attacker take control of the system locally without needing special permissions first.

CWE-77 command injection vulnerability in the engineermode service due to insufficient input validation. Local attacker can inject arbitrary commands through unvalidated parameters, leading to privilege escalation without requiring pre-existing elevated privileges or additional execution context.