QwikSec

Security Database

CVE

CWE

Training

CVE-2015-2279

Published: Jul 24, 2017

Modified: Aug 6, 2024

PUBLISHED

Description

cgi_test.cgi in AirLive BU-2015 with firmware 1.03.18, BU-3026 with firmware 1.43, and MD-3025 with firmware 1.81 allows remote attackers to execute arbitrary OS commands via shell metacharacters after an "&" (ampersand) in the write_mac write_pid, write_msn, write_tan, or write_hdv parameter.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

20150706 [CORE-2015-0012] - AirLive Multiple Products OS Command Injection

mailing-list

x_refsource_BUGTRAQ

http://packetstormsecurity.com/files/132585/AirLive-Remote-Command-Injection.html

x_refsource_MISC

20150706 [CORE-2015-0012] - AirLive Multiple Products OS Command Injection

mailing-list

x_refsource_FULLDISC

exploit

x_refsource_EXPLOIT-DB

vdb-entry

x_refsource_BID

https://www.coresecurity.com/advisories/airlive-multiple-products-os-command-injection

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.