CVE-2016-2297 Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited allows remote attackers to execute arbitrary commands via an "access command shell-like feature."
CriticalCVSS 9.4
EPSS 4.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited allows remote attackers to execute arbitrary commands via an "access command shell-like feature."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| meteocontrol weblog basic 100 | All versions | No fix listed |
| meteocontrol weblog light | All versions | No fix listed |
| meteocontrol weblog pro | All versions | No fix listed |
| meteocontrol weblog pro unlimited | All versions | No fix listed |
References
- 20160517 [ICS] Meteocontrol WEB'log Multiple Vulnerabilities mailing-list
- ics-cert.us-cert.gov third-party-advisory us-government-resource