An authenticated command injection vulnerability exists in the Polycom HDX Series shell interface accessible over Telnet. The lan traceroute devcmds console accepts unsanitized input, allowing attackers to execute arbitrary system commands. By injecting metacharacters through interface, an attacker can achieve remote code execution under context of root user. This flaw affects systems where Telnet access is enabled and either unauthenticated allowed or credentials are known.