CVE-2018-18600: OS Command Injection
Published Dec 31, 2018
·Updated
The remote upgrade feature in Guardzilla GZ180 devices allow command injection via a crafted new firmware version parameter.
Affected Software
8 affected components
Guardzilla 180 Outdoor Firmware
Guardzilla 180 Outdoor
Guardzilla 180 Indoor Firmware
Guardzilla 180 Indoor
All of the following
Guardzilla 180 Outdoor Firmware
Guardzilla 180 Outdoor
All of the following
Guardzilla 180 Indoor Firmware
Guardzilla 180 Indoor
Event History
Dec 31, 2018
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2018-18600?
CVE-2018-18600 is categorized as a high-severity vulnerability due to the potential for remote command injection.
2
How does CVE-2018-18600 affect Guardzilla devices?
CVE-2018-18600 allows attackers to perform command injection through the remote upgrade feature by sending a malicious firmware version parameter.
3
What devices are impacted by CVE-2018-18600?
CVE-2018-18600 affects Guardzilla GZ180 Indoor and Outdoor security cameras.
4
How can I mitigate CVE-2018-18600?
To mitigate CVE-2018-18600, ensure your Guardzilla devices are updated to the latest firmware version that addresses this vulnerability.
5
Is there a workaround for CVE-2018-18600?
Currently, the best workaround for CVE-2018-18600 is to disable the remote upgrade feature until a patch is applied.