CVE-2019-25671 - Vulnerability Analysis

Overview

VA MAX 8.3.4 contains a remote code execution caused by shell metacharacter injection in the mtu_eth0 parameter in changeip.php, letting authenticated attackers execute arbitrary commands as apache user.

Severity & Score

Impact

Authenticated attackers can execute arbitrary commands as the apache user, potentially compromising the system.

Mitigation

Update to the latest version.

References

• https://www.exploit-db.com/exploits/46348
• https://www.vulncheck.com/advisories/va-max-remote-code-execution-via-changeip-php

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner