9 - CVE-2014-8387

Executive Summary

This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.

Informations
Name	CVE-2014-8387	First vendor Publication	2014-11-20
Vendor	Cve	Last vendor Modification	2018-10-09

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:S/C:C/I:C/A:C)
Cvss Base Score	9	Attack Range	Network
Cvss Impact Score	10	Attack Complexity	Low
Cvss Expoit Score	8	Authentication	Requires single instance
Calculate full CVSS 2.0 Vectors scores

Detail

cgi/utility.cgi in Advantech EKI-6340 2.05 Wi-Fi Mesh Access Point allows remote authenticated users to execute arbitrary commands via shell metacharacters in the pinghost parameter to ping.cgi.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8387

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-78	Improper Sanitization of Special Elements used in an OS Command ('OS Command Injection') (CWE/SANS Top 25)

CPE : Common Platform Enumeration

Type	Description	Count
Hardware	Advantech Eki-6340 cpe:2.3:h:advantech:eki-6340:-:::::::*	1
Os	Advantech Eki-6340 Firmware cpe:2.3:o:advantech:eki-6340_firmware:2.05:::::::*	1

ExploitDB Exploits

id	Description
2014-11-24	Advantech EKI-6340 Command Injection

Sources (Detail)

Source	Url
BID	http://www.securityfocus.com/bid/71192
BUGTRAQ	http://www.securityfocus.com/archive/1/534021/100/0/threaded
FULLDISC	http://seclists.org/fulldisclosure/2014/Nov/58
MISC	http://www.coresecurity.com/advisories/advantech-eki-6340-command-injection