CVE-2019-17059

Опубликовано: 11 окт. 2019

Источник: nvd

CVSS3: 9.8

CVSS2: 10

EPSS Низкий

Описание

A shell injection vulnerability on the Sophos Cyberoam firewall appliance with CyberoamOS before 10.6.6 MR-6 allows remote attackers to execute arbitrary commands via the Web Admin and SSL VPN consoles.

Ссылки

https://community.sophos.com/kb/en-us/134732
Vendor Advisory
https://community.sophos.com/products/cyberoamos/
Vendor Advisory
https://thebestvpn.com/cyberoam-preauth-rce/
Exploit
Third Party Advisory
https://community.sophos.com/kb/en-us/134732
Vendor Advisory
https://community.sophos.com/products/cyberoamos/
Vendor Advisory
https://thebestvpn.com/cyberoam-preauth-rce/
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

Одно из

cpe:2.3:o:sophos:cyberoamos:*:*:*:*:*:*:*:*

Версия до 10.6.6 (исключая)

cpe:2.3:o:sophos:cyberoamos:10.6.6:-:*:*:*:*:*:*

cpe:2.3:o:sophos:cyberoamos:10.6.6:maintenance_release1:*:*:*:*:*:*

cpe:2.3:o:sophos:cyberoamos:10.6.6:maintenance_release2:*:*:*:*:*:*

cpe:2.3:o:sophos:cyberoamos:10.6.6:maintenance_release3:*:*:*:*:*:*

cpe:2.3:o:sophos:cyberoamos:10.6.6:maintenance_release4:*:*:*:*:*:*

cpe:2.3:o:sophos:cyberoamos:10.6.6:maintenance_release5:*:*:*:*:*:*

cpe:2.3:h:sophos:cyberoam:-:*:*:*:*:*:*:*

EPSS

Процентиль: 90%

0.05584

Низкий

9.8 Critical

CVSS3

10 Critical

CVSS2

Дефекты

CWE-78

Связанные уязвимости

GHSA-3vv5-g4c3-82fh