CVE Feed

    Dashboard / CVE / CVE-2015-2279

    CVE-2015-2279

    cgi_test.cgi in AirLive BU-2015 with firmware 1.03.18, BU-3026 with firmware 1.43, and MD-3025 with firmware 1.81 allows remote attackers to execute arbitrary OS commands via shell metacharacters after an "&" (ampersand) in the write_mac write_pid, write_msn, write_tan, or write_hdv parameter.

    Published:Jul 24, 2017
    Last Modified:Apr 20, 2025
    EPS:Jul 24, 2017
    EPSS Score:0.42161
    CVSS Score:9.8

    Affected Products

    Vendor
    Airlive
    Product
    Bu-2015
    Vendor
    Airlive
    Product
    Bu-2015 Firmware
    Vendor
    Airlive
    Product
    Bu-3026
    Vendor
    Airlive
    Product
    Bu-3026 Firmware
    Vendor
    Airlive
    Product
    Md-3025
    Vendor
    Airlive
    Product
    Md-3025 Firmware

    Exploits

    http://packetstormsecurity.com/files/132585/AirLive-Remote-Command-Injection.htmlhttp://seclists.org/fulldisclosure/2015/Jul/29https://www.coresecurity.com/advisories/airlive-multiple-products-os-command-injectionhttps://www.exploit-db.com/exploits/37532/http://packetstormsecurity.com/files/132585/AirLive-Remote-Command-Injection.htmlhttp://seclists.org/fulldisclosure/2015/Jul/29https://www.coresecurity.com/advisories/airlive-multiple-products-os-command-injectionhttps://www.exploit-db.com/exploits/37532/https://www.exploit-db.com/exploits/37532

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High