Raisecom SSLVPN vulnerability could allow remote command injection
Key Information
- Vendor
- Raisecom
- Status
- Msg1200
- Msg2100e
- Msg2200
- Msg2300
- Vendor
- CVE Published:
- 5 August 2024
Summary
A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90. It has been classified as critical. This affects the function sslvpn_config_mod of the file /vpn/list_service_manage.php of the component Web Interface. The manipulation of the argument template/stylenum leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273561 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Affected Version(s)
MSG1200 = 3.90
MSG2100E = 3.90
MSG2200 = 3.90
EPSS Score
1% chance of being exploited in the next 30 days.
CVSS V3.1
Timeline
Risk change from: null to: 6.3 - (MEDIUM)
Vulnerability published.
VulDB entry last update
Vulnerability Reserved.
VulDB entry created
Advisory disclosed