CVE-2018-15477 myStrom WiFi Switch V1 devices before 2.66 did not sanitize a parameter received from the cloud that was used in an OS command. Malicious servers were able to run operating system commands on the devi...
CriticalCVSS 9.8
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
myStrom WiFi Switch V1 devices before 2.66 did not sanitize a parameter received from the cloud that was used in an OS command. Malicious servers were able to run operating system commands on the device.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mystrom wifi switch firmware | < 2.66 | 2.66 |
References
- www.swisscom.ch third-party-advisory