Към съдържанието
Търсене

CVE-2026-2670: Advantech WISE-6610-NB, инжекция

8.6

CVSS 4.0

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, с администраторски права и без действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: има публичен пример за експлоатация
  • Атаката не може да се автоматизира

Описание

Оригинално описание

A vulnerability was identified in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_20251110. Affected is an unknown function of the file /cgi-bin/luci/admin/openvpn_apply of the component Background Management. Such manipulation of the argument delete_file leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. Upgrading to version 1.2.4_20260821 is able to address this issue. It is advisable to upgrade the affected component. The vendor explains: "The delete operation has been redesigned to map the requested file type to a fixed allowlisted path, require a numeric tunnel ID, reject invalid requests, and use the native filesystem API (fs.unlink) instead of constructing a shell command from request data."

Засегнати продукти

  • Advantech WISE-6610-NB: 1.2.1_20251110; 1.2.4_20260821
  • Advantech WISE-6610-EB: 1.2.1_20251110; 1.2.4_20260821
  • Advantech WISE-6610-TB: 1.2.1_20251110; 1.2.4_20260821
  • Advantech WISE-6610-JB: 1.2.1_20251110; 1.2.4_20260821
  • Advantech WISE-6610-CB: 1.2.1_20251110; 1.2.4_20260821
  • Advantech WISE-6610-EL-NB: 1.2.1_20251110; 1.2.4_20260821
  • Advantech WISE-6610-EL-EB: 1.2.1_20251110; 1.2.4_20260821
  • Advantech WISE-6610-EL-TB: 1.2.1_20251110; 1.2.4_20260821
  • Advantech WISE-6610-EL-JB: 1.2.1_20251110; 1.2.4_20260821
  • Advantech WISE-6610-EL-CB: 1.2.1_20251110; 1.2.4_20260821
  • Advantech WISE-6610P-DEA: 1.2.1_20251110; 1.2.4_20260821
  • Advantech WISE-6610P-DNA: 1.2.1_20251110; 1.2.4_20260821
  • Advantech WISE-6610P-DTA: 1.2.1_20251110; 1.2.4_20260821

Вид слабост

История

  • 18 февруари 2026 Публикувано

Други уязвимости в Advantech WISE-6610-NB

Първоизточници

CVE-2026-2670: Advantech WISE-6610-NB, инжекция | freedomonline.bg