同じ製品で同じ時期に公表された 2 件の脆弱性の 1 つです。まとめた解説: VW2100/VEC10GPで認証なしにコマンド実行、修正版なし
A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825...
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This issue affects the function add_expmac of the file var/html/webserver of the component Web Administration Interface. The manipulation of the argument mac results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
出典: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
参照URL
- web cna@vuldb.com
- web cna@vuldb.com
- web cna@vuldb.com
- web cna@vuldb.com
- web cna@vuldb.com
- web nvd.nist.gov
- web github.com