CVE-2019-25671 - VA MAX 8.3.4 Remote Code Execution via changeip.php

Back Back to CVE browser

HIGH

VA MAX 8.3.4 Remote Code Execution via changeip.php

Published Apr 5, 2026

8.7

HIGH

CVSS 4.0

EPSS 0.66%

Description

VA MAX 8.3.4 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands by injecting shell metacharacters into the mtu_eth0 parameter. Attackers can send POST requests to the changeip.php endpoint with malicious payload in the mtu_eth0 field to execute commands as the apache user.

Affected products

Vendor VA Max Product VA Max Default
n/a
- Version
  8.3.4
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

VA Max

n/a

Version	Status	Constraints
8.3.4	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (2)

https://www.exploit-db.com/exploits/46348
exploit
https://www.vulncheck.com/advisories/va-max-remote-code-execution-via-changeip-php
third-party-advisory

Link	Providers	Tags
https://www.exploit-db.com/exploits/46348		exploit
https://www.vulncheck.com/advisories/va-max-remote-code-execution-via-changeip-php		third-party-advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner VulnCheck

Published Apr 5, 2026

Updated Apr 6, 2026

Reserved Apr 5, 2026

Link CVE-2019-25671

CISA Vulnrichment

Updated Apr 6, 2026

NVD

Status Deferred

Modified Jul 24, 2026

Link CVE-2019-25671

Red Hat

Severity n/a

Public date n/a

Links CVE-2019-25671