CVE-2018-15484

Опубликовано: 07 сент. 2018

Источник: nvd

CVSS3: 9.8

CVSS2: 10

EPSS Низкий

Описание

An issue was discovered on KONE Group Controller (KGC) devices before 4.6.5. Unauthenticated Remote Code Execution is possible through the open HTTP interface by modifying autoexec.bat, aka KONE-01.

Ссылки

http://packetstormsecurity.com/files/149252/KONE-KGC-4.6.4-DoS-Code-Execution-LFI-Bypass.html
Third Party Advisory
VDB Entry
https://www.kone.com/en/vulnerability.aspx
Vendor Advisory
http://packetstormsecurity.com/files/149252/KONE-KGC-4.6.4-DoS-Code-Execution-LFI-Bypass.html
Third Party Advisory
VDB Entry
https://www.kone.com/en/vulnerability.aspx
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:kone:group_controller_firmware:*:*:*:*:*:*:*:*

Версия до 4.6.5 (исключая)

cpe:2.3:h:kone:group_controller:-:*:*:*:*:*:*:*

EPSS

Процентиль: 91%

0.06348

Низкий

9.8 Critical

CVSS3

10 Critical

CVSS2

Дефекты

CWE-78

Связанные уязвимости

GHSA-cfxv-cc2j-rww7