ucopia vulnerabilities

Products

• wireless appliance firmware 4
• ucopia wireless appliance 3
• weblib 2
• express wireless appliance 1
• wireless appliance 1

Latest ucopia CVEs

Newest publication first

1. CVE-2022-44720 An issue was discovered in Weblib Ucopia before 6.0.13. OS Command Injection injection can occur, related to chroot.

   Published 2023-06-29

   Critical·CVSS 9.8

   An issue was discovered in Weblib Ucopia before 6.0.13. OS Command Injection injection can occur, related to chroot.

2. CVE-2022-44719 An issue was discovered in Weblib Ucopia before 6.0.13. The SSH Server has Insecure Permissions.

   Published 2023-06-29

   High·CVSS 7.5

   An issue was discovered in Weblib Ucopia before 6.0.13. The SSH Server has Insecure Permissions.

3. CVE-2020-25036 UCOPIA Wi-Fi appliances 6.0.5 allow authenticated remote attackers to escape the restricted administration shell CLI, and access a shell with admin user rights, via an unprotected less command.

   Published 2021-02-02

   High·CVSS 8.8

   UCOPIA Wi-Fi appliances 6.0.5 allow authenticated remote attackers to escape the restricted administration shell CLI, and access a shell with admin user rights, via an unprotected less command.

4. CVE-2020-25035 UCOPIA Wi-Fi appliances 6.0.5 allow arbitrary code execution with root privileges using chroothole_client's PHP call, a related issue to CVE-2017-11322.

   Published 2021-02-02

   Medium·CVSS 6.7

   UCOPIA Wi-Fi appliances 6.0.5 allow arbitrary code execution with root privileges using chroothole_client's PHP call, a related issue to CVE-2017-11322.

5. CVE-2020-25037 UCOPIA Wi-Fi appliances 6.0.5 allow arbitrary code execution with admin user privileges via an escape from a restricted command.

   Published 2021-02-02

   High·CVSS 8.2

   UCOPIA Wi-Fi appliances 6.0.5 allow arbitrary code execution with admin user privileges via an escape from a restricted command.

6. CVE-2018-15481 Improper input sanitization within the restricted administration shell on UCOPIA Wireless Appliance devices using firmware version 5.1.x before 5.1.13 allows authenticated remote attackers to escape t...

   Published 2018-08-21

   High·CVSS 8.8

   Improper input sanitization within the restricted administration shell on UCOPIA Wireless Appliance devices using firmware version 5.1.x before 5.1.13 allows authenticated remote attackers to escape the shell and escalate their privileges by adding a LocalCommand to the SSH confi...

7. CVE-2017-17743 Improper input sanitization within the restricted administration shell on UCOPIA Wireless Appliance devices before 4.4.20, 5.0.x before 5.0.19, and 5.1.x before 5.1.11 allows authenticated remote atta...

   Published 2018-03-22

   Medium·CVSS 6.7

   Improper input sanitization within the restricted administration shell on UCOPIA Wireless Appliance devices before 4.4.20, 5.0.x before 5.0.19, and 5.1.x before 5.1.11 allows authenticated remote attackers to escape the shell and escalate their privileges by uploading a .bashrc f...

8. CVE-2017-11322 The chroothole_client executable in UCOPIA Wireless Appliance before 5.1.8 allows remote attackers to gain root privileges via a dollar sign ($) metacharacter in the argument to chroothole_client.

   Published 2017-10-03

   High·CVSS 8.2 EPSS 5.1%

   The chroothole_client executable in UCOPIA Wireless Appliance before 5.1.8 allows remote attackers to gain root privileges via a dollar sign ($) metacharacter in the argument to chroothole_client.

9. CVE-2017-11321 The restricted shell interface in UCOPIA Wireless Appliance before 5.1.8 allows remote authenticated users to gain 'admin' privileges via shell metacharacters in the less command.

   Published 2017-10-03

   High·CVSS 7.2 EPSS 8.3%

   The restricted shell interface in UCOPIA Wireless Appliance before 5.1.8 allows remote authenticated users to gain 'admin' privileges via shell metacharacters in the less command.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.