CVE-2015-2279 cgi_test.cgi in AirLive BU-2015 with firmware 1.03.18, BU-3026 with firmware 1.43, and MD-3025 with firmware 1.81 allows remote attackers to execute arbitrary OS commands via shell metacharacters afte...
CriticalCVSS 9.8
EPSS 17.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
cgi_test.cgi in AirLive BU-2015 with firmware 1.03.18, BU-3026 with firmware 1.43, and MD-3025 with firmware 1.81 allows remote attackers to execute arbitrary OS commands via shell metacharacters after an "&" (ampersand) in the write_mac write_pid, write_msn, write_tan, or write_hdv parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| airlive bu-2015 firmware | = 1.03.18 | No fix listed |
| airlive bu-3026 firmware | = 1.43 | No fix listed |
| airlive md-3025 firmware | = 1.81 | No fix listed |
References
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- 20150706 [CORE-2015-0012] - AirLive Multiple Products OS Command Injection exploit mailing-list third-party-advisory vdb-entry
- 20150706 [CORE-2015-0012] - AirLive Multiple Products OS Command Injection mailing-list
- 75559 third-party-advisory vdb-entry
- www.coresecurity.com exploit technical-description third-party-advisory
- 37532 exploit third-party-advisory vdb-entry