The parse_command function in Genecys 0.2 and earlier allows remote attackers to cause a denial of service (crash) via a command with a missing \:\ (colon) separator which triggers a null dereference.