Avocent ACS8000 wsserver command injection

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

The root-privileged wsserver terminal-bridge daemon builds a shell command from client-supplied WebSocket fields and passes it to system() and popen() without quoting, escaping, or character-set validation. The daemon's public-key session path performs no appliance-session check.

Etkilenen sürümler1 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• runzero.com/…avocent-acs8000-wsserver-cmdinj-cve-2026-65184 Üçüncü taraf
• runzero.com/blog/lights-out-exposed Diğer

Kayıt geçmişi

1. 26 Eki 2026 17:07Yayımlandı

İlgili açıklar

• 10,0 CVE-2026-61567AVideo-Encoder: unauthenticated command execution through streamer login trust
• 7,2 CVE-2026-118755Volmarg Personal Management System through 2.1.0 OS Command Injection via Storage Folder Path
• 7,0 CVE-2026-118692CherryTree through 1.7.2 OS Command Injection via Custom Web Link Action
• 8,8 CVE-2026-78674Remote Code Execution via BPMN System REST APIs in Multiple WSO2 Products Permits Arbitrary Command Execution
• 7,8 CVE-2026-118615Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability
• 6,8 CVE-2026-118607Alpine iLX-F511 diagapp Command Injection Vulnerability