Description
A command injection vulnerability exists in EdgeSwitch firmware <v1.9.0 that allowed an authenticated read-only user to execute arbitrary shell commands over the HTTP interface, allowing them to escalate privileges.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a EdgeSwitch firmware v1.9.0 and prior
Fixed version EdgeSwitch firmware v1.9.1affected
References
- https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821 ↗
- https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695c ↗
- https://www.ui.com/download/edgemax ↗
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00019.html ↗