In cmd services, there is a OS command injection issue due to missing permission check. This could lead to local escalation of privilege with system execution privileges needed.
https://www.unisoc.com/en_us/secy/announcementDetail/1621031430231134210