Auth Command Injection Vulnerability in Computrols CBAS from Computrols
CVE-2019-10854

8.8HIGH

Key Information:

Vendor

Computrols

Status
Computrols Building Automation Software
Vendor
CVE Published:
23 May 2019

What is CVE-2019-10854?

An authenticated command injection vulnerability exists in Computrols CBAS version 18.0.0 that could allow an attacker with valid user credentials to execute arbitrary commands on the server. This type of vulnerability requires users to be authenticated, but once exploited, can have serious implications on system integrity and security. Proper validation and sanitization of user inputs are essential to mitigate this risk. For more detailed information, refer to the advisories published by Applied Risk.

References

https://applied-risk.com/labs/advisories
x_refsource_MISC
https://applied-risk.com/index.php/download_file/view/196...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.