Command Injection in Device Webserver

Executive Summary

This vulnerability exists in a device's webserver that exposes a REST API on the management network. The API uses token-based authentication. An authenticated attacker can exploit an operating system command injection flaw to send arbitrary commands to the device. These commands are executed with administrative permissions by the underlying operating system.

Useful 0 Not Useful 0

Impact Analysis

Exploiting this vulnerability allows an attacker with valid authentication to execute arbitrary commands on the device with administrative privileges. This can lead to full compromise of the device, including unauthorized access, data manipulation, disruption of services, and potential spread of malware.

Useful 0 Not Useful 0