CVE-2008-6554 : cgi-bin/script in Aztech ADSL2/2+ 4-port router 3.7.0 build 070426 allows remote attackers to execute arbitrary commands

cgi-bin/script in Aztech ADSL2/2+ 4-port router 3.7.0 build 070426 allows remote attackers to execute arbitrary commands via shell metacharacters in the query string.

Published 2009-03-30 20:30:01

Updated 2018-10-11 20:57:24

Source MITRE

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2008-6554

EPSS FAQ

1.59%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 86 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2008-6554

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
10.0	HIGH	AV:N/AC:L/Au:N/C:C/I:C/A:C	10.0	10.0	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

CWE ids for CVE-2008-6554

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Assigned by: nvd@nist.gov (Primary)

Products affected by CVE-2008-6554

Aztech » Adsl2/2+4-port Router » Version: 3.7.0
cpe:2.3:h:aztech:adsl2\/2\+4-port_router:3.7.0:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2008-6554

Exploit prediction scoring system (EPSS) score for CVE-2008-6554

CVSS scores for CVE-2008-6554

CWE ids for CVE-2008-6554

References for CVE-2008-6554

Products affected by CVE-2008-6554