by Kastro
Paper/Archive/CVE-2024-26260

CVE-2024-26260

Hgiga OAKlouds — Hgiga OAKlouds - Command Injection

EPSS 2%CVSS 9.8
critical.is priorityof 100
45
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 75.8.758 × 2015.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The functionality for synchronization in HGiga OAKlouds' certain moudules has an OS Command Injection vulnerability, allowing remote attackers to inject system commands within specific request parameters. This enables the execution of arbitrary code on the remote server without permission.

Affected

ProductAffectedFixed inSource
OAKloudsearlier – < 188188CNA
OAKloudsearlier – < 10511051CNA
oaklouds< 188188CISA-ADP
oaklouds< 10511051CISA-ADP

Scores by source

twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeuptwcert.org.tw/tw/cp-132-7673-688b7-1.htmlwriteupchtsecurity.com/news/e456f679-9091-4de4-8f78-9262d20d6a96