cgi-data/FastJSData.cgi in OmniPCX Office with Internet Access services OXO210 before 210/091.001 OXO600 before 610/014.001 and other versions allows remote attackers to execute arbitrary commands and \obtain OXO resources\ via shell metacharacters in the id2 parameter.