CVE-2007-3572 Incomplete blacklist vulnerability in cgi-bin/runDiagnostics.cgi in the web interface on the Yoggie Pico and Pico Pro allows remote attackers to execute arbitrary commands via shell metacharacters in....
HighCVSS 9.3
EPSS 8.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Incomplete blacklist vulnerability in cgi-bin/runDiagnostics.cgi in the web interface on the Yoggie Pico and Pico Pro allows remote attackers to execute arbitrary commands via shell metacharacters in the param parameter, as demonstrated by URL encoded "`" (backtick) characters (%60 sequences).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| yoggie pico | All versions | No fix listed |
| yoggie pico pro | All versions | No fix listed |
References
- 20070702 Yoggie Pico Pro Remote Code Execution exploit mailing-list
- 20070705 Re: Yoggie Pico Pro Remote Code Execution mailing-list
- 37808 vdb-entry
- 25902 exploit third-party-advisory vendor-advisory
- 24743 exploit vdb-entry
- ADV-2007-2417 vdb-entry
- yoggie-rundiagnostics-command-execution(35208) vdb-entry