HIGH🇬🇧 English

CVE-2018-18879

CVSS 8.8v3.0pub. 2019-06-18upd. 2024-11-21

In firmware version MS_2.6.9900 of Columbia Weather MicroServer, an authenticated web user can pipe commands directly to the underlying operating system as user input is not sanitized in networkdiags.php.

oryginał EN
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

  • Columbiaweather Weather Microserver

    HW
    Columbiaweather
    wszystkie wersje

  • Columbiaweather Weather Microserver Firmware

    OS
    Columbiaweather
    ms_2.6.9900
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
CWE
Referencje

Powiązane podatności

CVE-2025-66620HIGH8.6ten sam produkt

An unused webshell in MicroServer allows unlimited login attempts, with sudo rights on certain files and direc...

CVE-2025-61939HIGH8.7ten sam produkt

An unused function in MicroServer can start a reverse SSH connection to a vendor registered domain, without mu...

CVE-2018-18878HIGH7.5ten sam produkt

In firmware version MS_2.6.9900 of Columbia Weather MicroServer, the BACnet daemon does not properly validate ...

CVE-2018-18877HIGH8.8ten sam produkt

In firmware version MS_2.6.9900 of Columbia Weather MicroServer, an authenticated web user can access an alter...

CVE-2018-18880MEDIUM5.4ten sam produkt

In firmware version MS_2.6.9900 of Columbia Weather MicroServer, a networkdiags.php reflected Cross-site scrip...