CVE-2021-37913: HGiga OAKlouds - Command Injection-2
First published: Wed Sep 15 2021(Updated: )
The HGiga OAKlouds mobile portal does not filter special characters of the IPv6 Gateway parameter of the network interface card setting page. Remote attackers can use this vulnerability to perform command injection and execute arbitrary commands in the system without logging in.
Credit: twcert@cert.org.tw
| Affected Software | Affected Version | How to fix |
|---|---|---|
| HGiga OAKlouds | >=2.0<=2.0-2 | |
| HGiga OAKlouds | >=3.0<=3.0-2 |
Remedy
Update OAKlouds OAKSv2 to version OAKlouds-network-2.0-3 Update OAKlouds OAKSv3 to version OAKlouds-network-2.0-3
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- agent/weakness
- agent/type
- agent/softwarecombine
- agent/references
- agent/title
- agent/severity
- agent/remedy
- agent/author
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/first-publish-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/hgiga
- canonical/hgiga oaklouds
- version/hgiga oaklouds/2.0
- version/hgiga oaklouds/2.0-2
- version/hgiga oaklouds/3.0
- version/hgiga oaklouds/3.0-2