Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2025-46122

Summary
Assigner-mitre
Assigner Org ID-8254265b-2729-46b6-b9e3-3dfca2d5bfca
Published At-21 Jul, 2025 | 00:00
Updated At-23 Jul, 2025 | 17:16
Rejected At-
Credits

An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, where the authenticated diagnostics API endpoint `/admin/_cmdstat.jsp` passes attacker-controlled input to the shell without adequate validation, enabling a remote attacker to specify a target by MAC address and execute arbitrary commands as root.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
â–¼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:mitre
Assigner Org ID:8254265b-2729-46b6-b9e3-3dfca2d5bfca
Published At:21 Jul, 2025 | 00:00
Updated At:23 Jul, 2025 | 17:16
Rejected At:
â–¼CVE Numbering Authority (CNA)

An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, where the authenticated diagnostics API endpoint `/admin/_cmdstat.jsp` passes attacker-controlled input to the shell without adequate validation, enabling a remote attacker to specify a target by MAC address and execute arbitrary commands as root.

Affected Products
Vendor
n/a
Product
n/a
Versions
Affected
  • n/a
Problem Types
TypeCWE IDDescription
textN/An/a
Type: text
CWE ID: N/A
Description: n/a
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://support.ruckuswireless.com/security_bulletins/330
N/A
https://sector7.computest.nl/post/2025-07-ruckus-unleashed/
N/A
Hyperlink: https://support.ruckuswireless.com/security_bulletins/330
Resource: N/A
Hyperlink: https://sector7.computest.nl/post/2025-07-ruckus-unleashed/
Resource: N/A
â–¼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Problem Types
TypeCWE IDDescription
CWECWE-77CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Type: CWE
CWE ID: CWE-77
Description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Metrics
VersionBase scoreBase severityVector
3.19.1CRITICAL
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Version: 3.1
Base score: 9.1
Base severity: CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Information is not available yet
â–¼National Vulnerability Database (NVD)
nvd.nist.gov
Source:cve@mitre.org
Published At:21 Jul, 2025 | 15:15
Updated At:05 Aug, 2025 | 17:18

An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, where the authenticated diagnostics API endpoint `/admin/_cmdstat.jsp` passes attacker-controlled input to the shell without adequate validation, enabling a remote attacker to specify a target by MAC address and execute arbitrary commands as root.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary3.19.1CRITICAL
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Type: Secondary
Version: 3.1
Base score: 9.1
Base severity: CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CPE Matches
ruckuswireless
ruckuswireless
>>ruckus_unleashed>>Versions before 200.15.6.212.14(exclusive)
cpe:2.3:a:ruckuswireless:ruckus_unleashed:*:*:*:*:*:*:*:*
ruckuswireless
ruckuswireless
>>ruckus_unleashed>>Versions from 200.17(inclusive) to 200.17.7.0.139(exclusive)
cpe:2.3:a:ruckuswireless:ruckus_unleashed:*:*:*:*:*:*:*:*
ruckuswireless
ruckuswireless
>>ruckus_zonedirector>>Versions before 10.5.1.0.279(exclusive)
cpe:2.3:a:ruckuswireless:ruckus_zonedirector:*:*:*:*:*:*:*:*
commscope
commscope
>>ruckus_c110>>-
cpe:2.3:h:commscope:ruckus_c110:-:*:*:*:*:*:*:*
commscope
commscope
>>ruckus_e510>>-
cpe:2.3:h:commscope:ruckus_e510:-:*:*:*:*:*:*:*
commscope
commscope
>>ruckus_h320>>-
cpe:2.3:h:commscope:ruckus_h320:-:*:*:*:*:*:*:*
commscope
commscope
>>ruckus_h350>>-
cpe:2.3:h:commscope:ruckus_h350:-:*:*:*:*:*:*:*
commscope
commscope
>>ruckus_h510>>-
cpe:2.3:h:commscope:ruckus_h510:-:*:*:*:*:*:*:*
commscope
commscope
>>ruckus_h550>>-
cpe:2.3:h:commscope:ruckus_h550:-:*:*:*:*:*:*:*
commscope
commscope
>>ruckus_m510>>-
cpe:2.3:h:commscope:ruckus_m510:-:*:*:*:*:*:*:*
commscope
commscope
>>ruckus_m510-jp>>-
cpe:2.3:h:commscope:ruckus_m510-jp:-:*:*:*:*:*:*:*
commscope
commscope
>>ruckus_r310>>-
cpe:2.3:h:commscope:ruckus_r310:-:*:*:*:*:*:*:*
commscope
commscope
>>ruckus_r320>>-
cpe:2.3:h:commscope:ruckus_r320:-:*:*:*:*:*:*:*
commscope
commscope
>>ruckus_r350>>-
cpe:2.3:h:commscope:ruckus_r350:-:*:*:*:*:*:*:*
commscope
commscope
>>ruckus_r350e>>-
cpe:2.3:h:commscope:ruckus_r350e:-:*:*:*:*:*:*:*
commscope
commscope
>>ruckus_r510>>-
cpe:2.3:h:commscope:ruckus_r510:-:*:*:*:*:*:*:*
commscope
commscope
>>ruckus_r550>>-
cpe:2.3:h:commscope:ruckus_r550:-:*:*:*:*:*:*:*
commscope
commscope
>>ruckus_r560>>-
cpe:2.3:h:commscope:ruckus_r560:-:*:*:*:*:*:*:*
commscope
commscope
>>ruckus_r610>>-
cpe:2.3:h:commscope:ruckus_r610:-:*:*:*:*:*:*:*
commscope
commscope
>>ruckus_r650>>-
cpe:2.3:h:commscope:ruckus_r650:-:*:*:*:*:*:*:*
commscope
commscope
>>ruckus_r670>>-
cpe:2.3:h:commscope:ruckus_r670:-:*:*:*:*:*:*:*
commscope
commscope
>>ruckus_r710>>-
cpe:2.3:h:commscope:ruckus_r710:-:*:*:*:*:*:*:*
commscope
commscope
>>ruckus_r720>>-
cpe:2.3:h:commscope:ruckus_r720:-:*:*:*:*:*:*:*
commscope
commscope
>>ruckus_r730>>-
cpe:2.3:h:commscope:ruckus_r730:-:*:*:*:*:*:*:*
commscope
commscope
>>ruckus_r750>>-
cpe:2.3:h:commscope:ruckus_r750:-:*:*:*:*:*:*:*
commscope
commscope
>>ruckus_r760>>-
cpe:2.3:h:commscope:ruckus_r760:-:*:*:*:*:*:*:*
commscope
commscope
>>ruckus_r770>>-
cpe:2.3:h:commscope:ruckus_r770:-:*:*:*:*:*:*:*
commscope
commscope
>>ruckus_r850>>-
cpe:2.3:h:commscope:ruckus_r850:-:*:*:*:*:*:*:*
commscope
commscope
>>ruckus_t310c>>-
cpe:2.3:h:commscope:ruckus_t310c:-:*:*:*:*:*:*:*
commscope
commscope
>>ruckus_t310n>>-
cpe:2.3:h:commscope:ruckus_t310n:-:*:*:*:*:*:*:*
commscope
commscope
>>ruckus_t310s>>-
cpe:2.3:h:commscope:ruckus_t310s:-:*:*:*:*:*:*:*
commscope
commscope
>>ruckus_t350c>>-
cpe:2.3:h:commscope:ruckus_t350c:-:*:*:*:*:*:*:*
commscope
commscope
>>ruckus_t350d>>-
cpe:2.3:h:commscope:ruckus_t350d:-:*:*:*:*:*:*:*
commscope
commscope
>>ruckus_t350se>>-
cpe:2.3:h:commscope:ruckus_t350se:-:*:*:*:*:*:*:*
commscope
commscope
>>ruckus_t610>>-
cpe:2.3:h:commscope:ruckus_t610:-:*:*:*:*:*:*:*
commscope
commscope
>>ruckus_t670>>-
cpe:2.3:h:commscope:ruckus_t670:-:*:*:*:*:*:*:*
commscope
commscope
>>ruckus_t710>>-
cpe:2.3:h:commscope:ruckus_t710:-:*:*:*:*:*:*:*
commscope
commscope
>>ruckus_t710s>>-
cpe:2.3:h:commscope:ruckus_t710s:-:*:*:*:*:*:*:*
commscope
commscope
>>ruckus_t750>>-
cpe:2.3:h:commscope:ruckus_t750:-:*:*:*:*:*:*:*
commscope
commscope
>>ruckus_t750se>>-
cpe:2.3:h:commscope:ruckus_t750se:-:*:*:*:*:*:*:*
commscope
commscope
>>ruckus_t811-cm>>-
cpe:2.3:h:commscope:ruckus_t811-cm:-:*:*:*:*:*:*:*
commscope
commscope
>>ruckus_t811-cm_\(non-sfp\)>>-
cpe:2.3:h:commscope:ruckus_t811-cm_\(non-sfp\):-:*:*:*:*:*:*:*
commscope
commscope
>>zonedirector_1200>>-
cpe:2.3:h:commscope:zonedirector_1200:-:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-77Secondary134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE ID: CWE-77
Type: Secondary
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://sector7.computest.nl/post/2025-07-ruckus-unleashed/cve@mitre.org
Exploit
Third Party Advisory
https://support.ruckuswireless.com/security_bulletins/330cve@mitre.org
Product
Hyperlink: https://sector7.computest.nl/post/2025-07-ruckus-unleashed/
Source: cve@mitre.org
Resource:
Exploit
Third Party Advisory
Hyperlink: https://support.ruckuswireless.com/security_bulletins/330
Source: cve@mitre.org
Resource:
Product

Change History

0
Information is not available yet

Similar CVEs

63Records found
CVE-2024-1374
Matching Score-4
Assigner-GitHub, Inc. (Products Only)
ShareView Details
Matching Score-4
Assigner-GitHub, Inc. (Products Only)
CVSS Score-9.1||CRITICAL
EPSS-2.80% / 85.78%
||
7 Day CHG~0.00%
Published-13 Feb, 2024 | 18:54
Updated-09 May, 2025 | 18:18
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console

A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance via nomad templates when configuring audit log forwarding. Exploitation of this vulnerability required access to the GitHub Enterprise Server instance and access to the Management Console with the editor role. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fixed in versions 3.11.5, 3.10.7, 3.9.10, and 3.8.15. This vulnerability was reported via the GitHub Bug Bounty program https://bounty.github.com .

Action-Not Available
Vendor-GitHub, Inc.
Product-enterprise_serverEnterprise Server
CWE ID-CWE-20
Improper Input Validation
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2024-1355
Matching Score-4
Assigner-GitHub, Inc. (Products Only)
ShareView Details
Matching Score-4
Assigner-GitHub, Inc. (Products Only)
CVSS Score-9.1||CRITICAL
EPSS-0.47% / 63.93%
||
7 Day CHG~0.00%
Published-13 Feb, 2024 | 18:51
Updated-24 Mar, 2025 | 20:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console

A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance via the actions-console docker container while setting a service URL. Exploitation of this vulnerability required access to the GitHub Enterprise Server instance and access to the Management Console with the editor role. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fixed in versions 3.11.5, 3.10.7, 3.9.10, and 3.8.15. This vulnerability was reported via the GitHub Bug Bounty program.

Action-Not Available
Vendor-GitHub, Inc.
Product-enterprise_serverEnterprise Server
CWE ID-CWE-20
Improper Input Validation
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2024-1378
Matching Score-4
Assigner-GitHub, Inc. (Products Only)
ShareView Details
Matching Score-4
Assigner-GitHub, Inc. (Products Only)
CVSS Score-9.1||CRITICAL
EPSS-1.13% / 78.00%
||
7 Day CHG~0.00%
Published-13 Feb, 2024 | 18:54
Updated-16 Aug, 2024 | 19:08
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console

A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance via nomad templates when configuring SMTP options. Exploitation of this vulnerability required access to the GitHub Enterprise Server instance and access to the Management Console with the editor role. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fixed in versions 3.11.5, 3.10.7, 3.9.10, and 3.8.15. This vulnerability was reported via the GitHub Bug Bounty program https://bounty.github.com .

Action-Not Available
Vendor-GitHub, Inc.
Product-enterprise_serverEnterprise Serverenterprise_server
CWE ID-CWE-20
Improper Input Validation
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2024-11634
Matching Score-4
Assigner-Ivanti
ShareView Details
Matching Score-4
Assigner-Ivanti
CVSS Score-9.1||CRITICAL
EPSS-21.31% / 95.55%
||
7 Day CHG+6.36%
Published-10 Dec, 2024 | 18:48
Updated-17 Jan, 2025 | 19:32
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Command injection in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin privileges to achieve remote code execution. (Not applicable to 9.1Rx)

Action-Not Available
Vendor-Ivanti Software
Product-connect_securepolicy_securePolicy SecureConnect Secure
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2022-45796
Matching Score-4
Assigner-ZUSO Advanced Research Team (ZUSO ART)
ShareView Details
Matching Score-4
Assigner-ZUSO Advanced Research Team (ZUSO ART)
CVSS Score-9.1||CRITICAL
EPSS-3.18% / 86.65%
||
7 Day CHG~0.00%
Published-16 Dec, 2022 | 00:00
Updated-17 Apr, 2025 | 16:02
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
SHARP Multifunction Printer - Command Injection

Command injection vulnerability in nw_interface.html in SHARP multifunction printers (MFPs)'s Digital Full-color Multifunctional System 202 or earlier, 120 or earlier, 600 or earlier, 121 or earlier, 500 or earlier, 402 or earlier, 790 or earlier, and Digital Multifunctional System (Monochrome) 200 or earlier, 211 or earlier, 102 or earlier, 453 or earlier, 400 or earlier, 202 or earlier, 602 or earlier, 500 or earlier, 401 or earlier allows remote attackers to execute arbitrary commands via unspecified vectors.

Action-Not Available
Vendor-sharpSHARP
Product-mx-m6050mx-m6070_amx-3570n_firmwaremx-c303_firmwaremx-m6071_firmwarebp-60c36_firmwarebp-70m31bp-70m90_firmwaremx-3070v_amx-4070n_a_firmwaremx-m3571_firmwaremx-m3571mx-3050nmx-2651_firmwaremx-m2651mx-5070v_firmwarebp-60c36mx-b455wt_firmwaremx-3070vmx-4060n_firmwaremx-b355wz_firmwaremx-3050v_a_firmwarebp-50c26_firmwaremx-4060v_firmwaremx-3570vmx-c304w_firmwaremx-m5051mx-m3050mx-6050n_firmwaremx-3050v_amx-b376w_firmwaremx-5070n_firmwaremx-c303wh_firmwaremx-m5070bp-70c55_firmwaremx-b376whmx-4071s_firmwaremx-3550v_firmwaremx-b456whmx-m3071_firmwarebp-50c45_firmwaremx-4061_firmwaremx-3061smx-3070n_firmwaremx-3571s_firmwaremx-3560v_firmwarebp-50c26mx-3061_firmwarebp-30c25mx-b455w_firmwaremx-3571mx-7580n_firmwaremx-m1206bp-30c25z_firmwaremx-3550n_firmwaremx-7090nbp-30c25ymx-m4051mx-c303bp-50c55mx-4070n_firmwaremx-m4070_amx-b476wh_firmwaremx-m6070_firmwarebp-30m28t_firmwaremx-m3570mx-m4070bp-55c26_firmwaremx-5050n_firmwaremx-5070vmx-m5051_firmwaremx-m1206_firmwaremx-6071s_firmwaremx-5051mx-m3070_firmwaremx-4061s_firmwaremx-3051mx-b456wh_firmwaremx-b456wmx-3070v_firmwaremx-b355wt_firmwaremx-m3070mx-m4071_firmwaremx-3060v_firmwaremx-6071mx-3571sbp-30m35t_firmwaremx-m4071s_firmwaremx-m3551mx-m4051_firmwaremx-m6071s_firmwarebp-70c55mx-m5071mx-4050nbp-70c31mx-3561smx-m3050_firmwaremx-m4070_firmwaremx-3061s_firmwaremx-b356whmx-3070nmx-6050v_firmwaremx-4070v_firmwaremx-4070v_abp-70m75_firmwarebp-70m65mx-c304mx-4071smx-b356wh_firmwaremx-c303w_firmwaremx-6580nmx-c304wh_firmwarebp-50c65_firmwaremx-3551mx-3050v_firmwaremx-m7570mx-3060nbp-70c36mx-b376wmx-3050n_firmwaremx-7081_firmwaremx-m6050_firmwarebp-70m36_firmwarebp-50c55_firmwaremx-m905_firmwaremx-m4050_firmwaremx-m4071bp-50c45mx-m7570_firmwarebp-30m31tmx-3070v_a_firmwaremx-m1056mx-m3551_firmwaremx-m3051_firmwaremx-m3571smx-2630n_firmwaremx-8081mx-c303whmx-b355w_firmwarebp-70m31_firmwaremx-2630nmx-m6071bp-50m31mx-6070n_firmwarebp-30c25y_firmwaremx-3050n_abp-30c25tbp-70c65bp-70m55bp-30m28_firmwaremx-3570nmx-5050vbp-60c31_firmwarebp-70c36_firmwaremx-5071smx-4051mx-b455wtmx-m3050_a_firmwaremx-3060vmx-3061mx-m3071mx-m3550_firmwaremx-4060vbp-55c26mx-3071smx-3560n_firmwaremx-b455wzbp-50c36mx-m6070mx-m3571s_firmwaremx-3070n_abp-50c31_firmwaremx-5070nmx-m3071smx-8090nmx-m1056_firmwarebp-30m31_firmwaremx-c304_firmwarebp-50m36_firmwaremx-3551_firmwaremx-b476w_firmwaremx-6071_firmwaremx-b355wzbp-70m90mx-7580nmx-m6051_firmwaremx-4061mx-5071bp-50m45_firmwaremx-m2651_firmwarebp-50m55_firmwaremx-6070v_abp-30c25t_firmwaremx-c304whmx-3560nmx-m6070_a_firmwaremx-6050vbp-50m31_firmwaremx-b376wh_firmwarebp-70m45_firmwaremx-m5050_firmwaremx-6050nmx-4050vmx-m2630_a_firmwaremx-3050vmx-m905mx-m3570_firmwarebp-50c31mx-3561mx-4070n_amx-3571_firmwarebp-70c31_firmwaremx-5051_firmwaremx-4070vmx-b455wmx-c304wbp-50m26mx-5071s_firmwarebp-50m26_firmwarebp-50m45mx-3570v_firmwaremx-m4070_a_firmwaremx-m2630_abp-30c25zmx-m3070_a_firmwaremx-3051_firmwaremx-6051mx-m4071smx-6070n_amx-m3051mx-m4050mx-m5071s_firmwaremx-m2630_firmwaremx-m3070_amx-3071mx-m6051bp-50m55mx-c303wbp-70c65_firmwarebp-60c45bp-70m45bp-70m75mx-6070v_a_firmwarebp-30m35_firmwaremx-b476whmx-3071s_firmwaremx-6051_firmwaremx-m3550mx-4050n_firmwaremx-4061smx-4060nbp-50c36_firmwaremx-b456w_firmwaremx-3561s_firmwarebp-70c45bp-30m28mx-6071smx-4051_firmwarebp-60c31mx-4070v_a_firmwaremx-7090n_firmwarebp-50c65bp-50m50_firmwaremx-b356wmx-4071mx-b355wmx-7081mx-3561_firmwaremx-b476wmx-5050nmx-3560vbp-70m55_firmwaremx-b455wz_firmwaremx-m5071_firmwaremx-3550nmx-3070n_a_firmwaremx-2651mx-m2630mx-6070n_a_firmwarebp-70c45_firmwaremx-6070v_firmwaremx-4071_firmwarebp-30m35tbp-30c25_firmwaremx-4070nmx-m5050bp-70m65_firmwarebp-60c45_firmwaremx-3550vmx-m3050_amx-m6570_firmwarebp-30m35mx-b356w_firmwaremx-8081_firmwarebp-70m36mx-3071_firmwaremx-5050v_firmwarebp-30m31t_firmwaremx-6070vmx-6580n_firmwaremx-m6570mx-3050n_a_firmwaremx-m5070_firmwarebp-30m28tmx-3060n_firmwaremx-8090n_firmwaremx-m5071sbp-50m50mx-m3071s_firmwaremx-m6071smx-6070nmx-4050v_firmwarebp-50m36bp-30m31mx-b355wtmx-5071_firmwareSHARP multifunction printers
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2021-36024
Matching Score-4
Assigner-Adobe Systems Incorporated
ShareView Details
Matching Score-4
Assigner-Adobe Systems Incorporated
CVSS Score-9.1||CRITICAL
EPSS-8.67% / 92.26%
||
7 Day CHG~0.00%
Published-01 Sep, 2021 | 14:30
Updated-16 Sep, 2024 | 18:12
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Magento Commerce Improper Neutralization of Special Elements Used In A Command

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper Neutralization of Special Elements Used In A Command via the Data collection endpoint. An attacker with admin privileges can upload a specially crafted file to achieve remote code execution.

Action-Not Available
Vendor-Adobe Inc.
Product-magento_open_sourceadobe_commerceMagento Commerce
CWE ID-CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2023-36751
Matching Score-4
Assigner-Siemens
ShareView Details
Matching Score-4
Assigner-Siemens
CVSS Score-9.1||CRITICAL
EPSS-0.90% / 75.23%
||
7 Day CHG~0.00%
Published-11 Jul, 2023 | 09:07
Updated-26 Nov, 2024 | 16:42
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versions < V2.16.0), RUGGEDCOM ROX RX1510 (All versions < V2.16.0), RUGGEDCOM ROX RX1511 (All versions < V2.16.0), RUGGEDCOM ROX RX1512 (All versions < V2.16.0), RUGGEDCOM ROX RX1524 (All versions < V2.16.0), RUGGEDCOM ROX RX1536 (All versions < V2.16.0), RUGGEDCOM ROX RX5000 (All versions < V2.16.0). The install-app URL parameter in the web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.

Action-Not Available
Vendor-Siemens AG
Product-ruggedcom_rox_mx5000reruggedcom_rox_rx1511ruggedcom_rox_rx1512_firmwareruggedcom_rox_rx1512ruggedcom_rox_mx5000_firmwareruggedcom_rox_rx1511_firmwareruggedcom_rox_rx1510ruggedcom_rox_rx1400_firmwareruggedcom_rox_rx1500_firmwareruggedcom_rox_rx1400ruggedcom_rox_rx1510_firmwareruggedcom_rox_rx1500ruggedcom_rox_rx1524_firmwareruggedcom_rox_rx5000ruggedcom_rox_rx1501ruggedcom_rox_rx1536ruggedcom_rox_mx5000ruggedcom_rox_rx1524ruggedcom_rox_rx1536_firmwareruggedcom_rox_mx5000re_firmwareruggedcom_rox_rx1501_firmwareruggedcom_rox_rx5000_firmwareRUGGEDCOM ROX MX5000RERUGGEDCOM ROX RX1511RUGGEDCOM ROX RX1536RUGGEDCOM ROX RX1400RUGGEDCOM ROX RX1501RUGGEDCOM ROX RX1500RUGGEDCOM ROX RX5000RUGGEDCOM ROX MX5000RUGGEDCOM ROX RX1524RUGGEDCOM ROX RX1510RUGGEDCOM ROX RX1512ruggedcom_rox_mx5000reruggedcom_rox_rx1524ruggedcom_rox_rx1400ruggedcom_rox_rx1501ruggedcom_rox_rx1500ruggedcom_rox_rx1511ruggedcom_rox_rx5000ruggedcom_rox_rx1512ruggedcom_rox_rx1536ruggedcom_rox_mx5000ruggedcom_rox_rx1510
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2023-36754
Matching Score-4
Assigner-Siemens
ShareView Details
Matching Score-4
Assigner-Siemens
CVSS Score-9.1||CRITICAL
EPSS-0.75% / 72.74%
||
7 Day CHG~0.00%
Published-11 Jul, 2023 | 09:07
Updated-10 Dec, 2024 | 17:04
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versions < V2.16.0), RUGGEDCOM ROX RX1510 (All versions < V2.16.0), RUGGEDCOM ROX RX1511 (All versions < V2.16.0), RUGGEDCOM ROX RX1512 (All versions < V2.16.0), RUGGEDCOM ROX RX1524 (All versions < V2.16.0), RUGGEDCOM ROX RX1536 (All versions < V2.16.0), RUGGEDCOM ROX RX5000 (All versions < V2.16.0). The SCEP server configuration URL parameter in the web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.

Action-Not Available
Vendor-Siemens AG
Product-ruggedcom_rox_mx5000reruggedcom_rox_rx1511ruggedcom_rox_rx1512_firmwareruggedcom_rox_rx1512ruggedcom_rox_mx5000_firmwareruggedcom_rox_rx1511_firmwareruggedcom_rox_rx1510ruggedcom_rox_rx1400_firmwareruggedcom_rox_rx1500_firmwareruggedcom_rox_rx1400ruggedcom_rox_rx1510_firmwareruggedcom_rox_rx1500ruggedcom_rox_rx1524_firmwareruggedcom_rox_rx5000ruggedcom_rox_rx1501ruggedcom_rox_rx1536ruggedcom_rox_mx5000ruggedcom_rox_rx1524ruggedcom_rox_rx1536_firmwareruggedcom_rox_mx5000re_firmwareruggedcom_rox_rx1501_firmwareruggedcom_rox_rx5000_firmwareRUGGEDCOM ROX MX5000RERUGGEDCOM ROX RX1511RUGGEDCOM ROX RX1536RUGGEDCOM ROX RX1400RUGGEDCOM ROX RX1501RUGGEDCOM ROX RX1500RUGGEDCOM ROX RX5000RUGGEDCOM ROX MX5000RUGGEDCOM ROX RX1524RUGGEDCOM ROX RX1510RUGGEDCOM ROX RX1512
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2023-36755
Matching Score-4
Assigner-Siemens
ShareView Details
Matching Score-4
Assigner-Siemens
CVSS Score-9.1||CRITICAL
EPSS-0.77% / 73.14%
||
7 Day CHG~0.00%
Published-11 Jul, 2023 | 09:07
Updated-19 Nov, 2024 | 16:30
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versions < V2.16.0), RUGGEDCOM ROX RX1510 (All versions < V2.16.0), RUGGEDCOM ROX RX1511 (All versions < V2.16.0), RUGGEDCOM ROX RX1512 (All versions < V2.16.0), RUGGEDCOM ROX RX1524 (All versions < V2.16.0), RUGGEDCOM ROX RX1536 (All versions < V2.16.0), RUGGEDCOM ROX RX5000 (All versions < V2.16.0). The SCEP CA Certificate Name parameter in the web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.

Action-Not Available
Vendor-Siemens AG
Product-ruggedcom_rox_mx5000reruggedcom_rox_rx1511ruggedcom_rox_rx1512_firmwareruggedcom_rox_rx1512ruggedcom_rox_mx5000_firmwareruggedcom_rox_rx1511_firmwareruggedcom_rox_rx1510ruggedcom_rox_rx1400_firmwareruggedcom_rox_rx1500_firmwareruggedcom_rox_rx1400ruggedcom_rox_rx1510_firmwareruggedcom_rox_rx1500ruggedcom_rox_rx1524_firmwareruggedcom_rox_rx5000ruggedcom_rox_rx1501ruggedcom_rox_rx1536ruggedcom_rox_mx5000ruggedcom_rox_rx1524ruggedcom_rox_rx1536_firmwareruggedcom_rox_mx5000re_firmwareruggedcom_rox_rx1501_firmwareruggedcom_rox_rx5000_firmwareRUGGEDCOM ROX MX5000RERUGGEDCOM ROX RX1511RUGGEDCOM ROX RX1536RUGGEDCOM ROX RX1400RUGGEDCOM ROX RX1501RUGGEDCOM ROX RX1500RUGGEDCOM ROX RX5000RUGGEDCOM ROX MX5000RUGGEDCOM ROX RX1524RUGGEDCOM ROX RX1510RUGGEDCOM ROX RX1512ruggedcom_rox_mx5000reruggedcom_rox_rx1511ruggedcom_rox_rx1400ruggedcom_rox_rx1500ruggedcom_rox_rx5000ruggedcom_rox_rx1512ruggedcom_rox_rx1536ruggedcom_rox_mx5000ruggedcom_rox_rx1524
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2023-36750
Matching Score-4
Assigner-Siemens
ShareView Details
Matching Score-4
Assigner-Siemens
CVSS Score-9.1||CRITICAL
EPSS-0.90% / 75.23%
||
7 Day CHG~0.00%
Published-11 Jul, 2023 | 09:07
Updated-26 Nov, 2024 | 18:40
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versions < V2.16.0), RUGGEDCOM ROX RX1510 (All versions < V2.16.0), RUGGEDCOM ROX RX1511 (All versions < V2.16.0), RUGGEDCOM ROX RX1512 (All versions < V2.16.0), RUGGEDCOM ROX RX1524 (All versions < V2.16.0), RUGGEDCOM ROX RX1536 (All versions < V2.16.0), RUGGEDCOM ROX RX5000 (All versions < V2.16.0). The software-upgrade Url parameter in the web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.

Action-Not Available
Vendor-Siemens AG
Product-ruggedcom_rox_mx5000reruggedcom_rox_rx1511ruggedcom_rox_rx1512_firmwareruggedcom_rox_rx1512ruggedcom_rox_mx5000_firmwareruggedcom_rox_rx1511_firmwareruggedcom_rox_rx1510ruggedcom_rox_rx1400_firmwareruggedcom_rox_rx1500_firmwareruggedcom_rox_rx1400ruggedcom_rox_rx1510_firmwareruggedcom_rox_rx1500ruggedcom_rox_rx1524_firmwareruggedcom_rox_rx5000ruggedcom_rox_rx1501ruggedcom_rox_rx1536ruggedcom_rox_mx5000ruggedcom_rox_rx1524ruggedcom_rox_rx1536_firmwareruggedcom_rox_mx5000re_firmwareruggedcom_rox_rx1501_firmwareruggedcom_rox_rx5000_firmwareRUGGEDCOM ROX MX5000RERUGGEDCOM ROX RX1511RUGGEDCOM ROX RX1536RUGGEDCOM ROX RX1400RUGGEDCOM ROX RX1501RUGGEDCOM ROX RX1500RUGGEDCOM ROX RX5000RUGGEDCOM ROX MX5000RUGGEDCOM ROX RX1524RUGGEDCOM ROX RX1510RUGGEDCOM ROX RX1512ruggedcom_rox_mx5000reruggedcom_rox_rx1524ruggedcom_rox_rx1400ruggedcom_rox_rx1501ruggedcom_rox_rx1500ruggedcom_rox_rx1511ruggedcom_rox_rx5000ruggedcom_rox_rx1512ruggedcom_rox_rx1536ruggedcom_rox_mx5000ruggedcom_rox_rx1510
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2023-28365
Matching Score-4
Assigner-HackerOne
ShareView Details
Matching Score-4
Assigner-HackerOne
CVSS Score-9.1||CRITICAL
EPSS-0.30% / 53.24%
||
7 Day CHG~0.00%
Published-30 Jun, 2023 | 23:40
Updated-12 Dec, 2024 | 18:54
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A backup file vulnerability found in UniFi applications (Version 7.3.83 and earlier) running on Linux operating systems allows application administrators to execute malicious commands on the host device being restored.

Action-Not Available
Vendor-Ubiquiti Inc.Linux Kernel Organization, Inc
Product-unifi_network_applicationlinux_kernelUniFi Network applicationunifi_network_application
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2023-20017
Matching Score-4
Assigner-Cisco Systems, Inc.
ShareView Details
Matching Score-4
Assigner-Cisco Systems, Inc.
CVSS Score-6.5||MEDIUM
EPSS-0.06% / 18.46%
||
7 Day CHG~0.00%
Published-16 Aug, 2023 | 21:01
Updated-02 Aug, 2024 | 08:57
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Multiple vulnerabilities in Cisco Intersight Private Virtual Appliance could allow an authenticated, remote attacker to execute arbitrary commands using root-level privileges. The attacker would need to have Administrator privileges on the affected device to exploit these vulnerabilities. These vulnerabilities are due to insufficient input validation when extracting uploaded software packages. An attacker could exploit these vulnerabilities by authenticating to an affected device and uploading a crafted software package. A successful exploit could allow the attacker to execute commands on the underlying operating system with root-level privileges.

Action-Not Available
Vendor-Cisco Systems, Inc.
Product-intersight_private_virtual_applianceCisco Intersight Virtual Appliance
CWE ID-CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2024-54794
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.1||CRITICAL
EPSS-0.36% / 57.40%
||
7 Day CHG~0.00%
Published-21 Jan, 2025 | 00:00
Updated-17 Oct, 2025 | 16:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The script input feature of SpagoBI 3.5.1 allows arbitrary code execution.

Action-Not Available
Vendor-engn/a
Product-spagobin/a
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
  • Previous
  • 1
  • 2
  • Next
Details not found