CVE-2018-5265 Ubiquiti EdgeOS 1.9.1 on EdgeRouter Lite devices allows remote attackers to execute arbitrary code with admin credentials, because /opt/vyatta/share/vyatta-cfg/templates/system/static-host-mapping/hos...
HighCVSS 7.2
EPSS 2.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Ubiquiti EdgeOS 1.9.1 on EdgeRouter Lite devices allows remote attackers to execute arbitrary code with admin credentials, because /opt/vyatta/share/vyatta-cfg/templates/system/static-host-mapping/host-name/node.def does not sanitize the 'alias' or 'ips' parameter for shell metacharacters.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ui edgeos | = 1.9.1 | No fix listed |
References
- www.red4sec.com exploit third-party-advisory