Authenticated root command execution via unsanitized OPS filename

Command injection in affected Huawei NetEngine AR6000 firmware allows remote authenticated users to execute commands as root through OPS. OPS_Cfg_ScriptAssistInstall concatenates the attacker-controlled script filename into a chmod command and passes it to PAT_SystemCall without neutralizing shell metacharacters. Exploitation requires authenticated network access, an uploaded Python file meeting the filename constraints, and invocation of the OPS Script Assistant; the injected command runs with root privileges, although a standalone reverse shell requires additional conditions.