Описание
A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The source of the vulnerability relies on multiple parameters belonging to the "snmp_apply" API which are not properly sanitized before being concatenated to OS level commands.
Ссылки
- Third Party Advisory
Уязвимые конфигурации
Одновременно
Одновременно
Одновременно
EPSS
7.2 High
CVSS3
Дефекты
Связанные уязвимости
A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The source of the vulnerability relies on multiple parameters belonging to the "snmp_apply" API which are not properly sanitized before being concatenated to OS level commands.
Уязвимость прикладного программного интерфейса «snmp_apply» микропрограммного обеспечения многофункциональных беспроводных точек доступа Advantech EKI-6333AC-2G, EKI-6333AC-2GD и EKI-6333AC-1GPO, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
EPSS
7.2 High
CVSS3