10

CVE-2015-2279

Exploit
cgi_test.cgi in AirLive BU-2015 with firmware 1.03.18, BU-3026 with firmware 1.43, and MD-3025 with firmware 1.81 allows remote attackers to execute arbitrary OS commands via shell metacharacters after an "&" (ampersand) in the write_mac write_pid, write_msn, write_tan, or write_hdv parameter.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Airlive ≫ Bu-2015 Firmware Version1.03.18
   Airlive ≫ Bu-2015 Version-
Airlive ≫ Bu-3026 Firmware Version1.43
   Airlive ≫ Bu-3026 Version-
Airlive ≫ Md-3025 Firmware Version1.81
   Airlive ≫ Md-3025 Version-
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 17.62% 0.968
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

http://packetstormsecurity.com/files/132585/AirLive-Remote-Command-Injection.html
Third Party Advisory
Exploit
VDB Entry
http://seclists.org/fulldisclosure/2015/Jul/29
Third Party Advisory
Exploit
VDB Entry
Mailing List
http://www.securityfocus.com/archive/1/535938/100/0/threaded
http://www.securityfocus.com/bid/75559
Third Party Advisory
VDB Entry
https://www.coresecurity.com/advisories/airlive-multiple-products-os-command-injection
Third Party Advisory
Exploit
Technical Description
https://www.exploit-db.com/exploits/37532/
Third Party Advisory
Exploit
VDB Entry