CVE-2018-18879 - In firmware version MS_2.6.9900 of Columbia Weather MicroServer, an authenticated web user can pipe commands directly to the underlying operating system as user input is not sanitized in networkdiags.php

Back Back to CVE browser

HIGH

In firmware version MS_2.6.9900 of Columbia Weather MicroServer, an authenticated web user can pipe commands directly to the underlying operating system as user input is not sanitized in networkdiags.php

Published Jun 18, 2019

8.8

HIGH

CVSS 3.0

EPSS 2.05%

Description

In firmware version MS_2.6.9900 of Columbia Weather MicroServer, an authenticated web user can pipe commands directly to the underlying operating system as user input is not sanitized in networkdiags.php.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-94

Code Injection

References (3)

https://applied-risk.com/labs/advisories
x_refsource_MISCThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-10590
Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-19-078-02
x_refsource_MISCThird Party AdvisoryUS Government Resource

Link	Providers	Tags
https://applied-risk.com/labs/advisories		x_refsource_MISCThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-10590		Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-19-078-02		x_refsource_MISCThird Party AdvisoryUS Government Resource