CVE-2012-0262

Published: Dec 31, 2013Modified: Apr 29, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

op5config/welcome in system-op5config before 2.0.3 in op5 Monitor and op5 Appliance before 5.5.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the password parameter.

Affected (6)

Products: Op5: Monitor, System Op5config

Op5

2 products

Monitor

System Op5config

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Op5 Monitor	Up to 5.5.1
Op5 Monitor	Version 5.3.5
Op5 Monitor	Version 5.4.0
Op5 Monitor	Version 5.4.2
Op5 Monitor	Version 5.5.0
Op5 System Op5config	Up to 2.0.2

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (12)

http://seclists.org/fulldisclosure/2012/Jan/62

Source: cve@mitre.org

http://secunia.com/advisories/47417

Source: cve@mitre.org

Vendor Advisory

http://www.ekelow.se/file_uploads/Advisories/ekelow-aid-2012-01.pdf

Source: cve@mitre.org

Exploit

http://www.op5.com/news/support-news/fixed-vulnerabilities-op5-monitor-op5-appliance/

Source: cve@mitre.org

http://www.osvdb.org/78065

Source: cve@mitre.org

https://bugs.op5.com/view.php?id=5094

Source: cve@mitre.org

http://seclists.org/fulldisclosure/2012/Jan/62