CVE-2024-0778
Uniview ISC 2500-S VM.php setNatConfig os command injection
Basic Information
- CVE State
- PUBLISHED
- Reserved Date
- January 22, 2024
- Published Date
- January 22, 2024
- Last Updated
- August 01, 2024
- Vendor
- Uniview
- Product
- ISC 2500-S
- Description
- ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in Uniview ISC 2500-S up to 20210930. Affected by this issue is the function setNatConfig of the file /Interface/DevManage/VM.php. The manipulation of the argument natAddress/natPort/natServerPort leads to os command injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-251696. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced. Eine kritische Schwachstelle wurde in Uniview ISC 2500-S bis 20210930 entdeckt. Es geht hierbei um die Funktion setNatConfig der Datei /Interface/DevManage/VM.php. Mittels dem Manipulieren des Arguments natAddress/natPort/natServerPort mit unbekannten Daten kann eine os command injection-Schwachstelle ausgenutzt werden. Der Exploit steht zur öffentlichen Verfügung.
CVSS Scores
CVSS v3.1
8.0 - HIGH
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v3.0
8.0 - HIGH
Vector: CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0
7.7 -
Vector: AV:A/AC:L/Au:S/C:C/I:C/A:C
EPSS Score
- Score
- 29.84% (Percentile: 96.33%) as of 2025-04-29
Exploit Status
- Exploited in the Wild
- Yes (added 2025-04-26 00:00:00 UTC) Source
References
Known Exploited Vulnerability Information
| Source | Added Date |
|---|---|
| The Shadowserver (via CIRCL) | 2025-04-26 00:00:00 UTC |