JOYS is an operating system for thin client made by Shenzhen Jieyun zhilian Technology Co., Ltd. During the boot procedure, the user can set some settings and take dianosis. However, there is inappropriate sanitization of the user input in the Network Diagnosis function (no authentication needed), leading to arbitrary command execution with root permission. This can be achieved quite simply by using a semicolon before the command. E.g., ; whoami This vulnerability was tested on up-to-date JYOS, and it is platform-agnostic. Both ARM and x86_64 distributions were affected.