EIP-2026-101734

This exploit demonstrates a command injection vulnerability in FlexAir Access Control (Prima Systems) firmware version <= 2.3.38. It leverages the 'GoogleAccessToken' parameter in an XML payload to execute arbitrary commands with root privileges via a POST request to '/bin/sysfcgi.fx'.