An issue was discovered in Pascom Cloud Phone System before 7.20.x. In the management REST API, /services/apply in exd.pl allows remote attackers to execute arbitrary code via shell metacharacters.
References
| Link | Resource |
|---|---|
| https://kerbit.io/research/read/blog/4 | Exploit Third Party Advisory |
| https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.html | Exploit Third Party Advisory |
| https://www.pascom.net/doc/en/release-notes/ | Release Notes Vendor Advisory |
Configurations
History
12 Jul 2022, 17:42
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-78 |
25 Mar 2022, 18:52
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://kerbit.io/research/read/blog/4 - Exploit, Third Party Advisory | |
| References | (MISC) https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.html - Exploit, Third Party Advisory | |
| References | (MISC) https://www.pascom.net/doc/en/release-notes/ - Release Notes, Vendor Advisory | |
| CPE | cpe:2.3:a:pascom:cloud_phone_system:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : 10.0
v3 : 9.8 |
| CWE | CWE-77 |
18 Mar 2022, 05:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-03-18 05:15
Updated : 2024-02-04 22:29
NVD link : CVE-2021-45966
Mitre link : CVE-2021-45966
CVE.ORG link : CVE-2021-45966
JSON object : View
Products Affected
pascom
- cloud_phone_system
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')