PT-2014-5076 · Ibm · Ibm Gcm16+1

Alejandro Alvarez Bravo · Publicado 2014-08-17 · Atualizado 2017-08-29 · CVE-2014-3085

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM GCM16 and GCM32 Global Console Manager switches with firmware before 1.20.20.23447

Description The issue allows remote authenticated users to execute arbitrary commands via shell metacharacters in the lpres parameter in the systest.php file.

Recommendations For IBM GCM16 and GCM32 Global Console Manager switches with firmware before 1.20.20.23447, update the firmware to version 1.20.20.23447 or later to resolve the issue. As a temporary workaround, consider restricting access to the systest.php file to minimize the risk of exploitation. Avoid using the lpres parameter in the affected file until the issue is resolved.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2014-3085

Produtos afetados

Ibm Gcm16

Ibm Gcm32

Referências · 6

• 🔥 https://exploit-db.com/exploits/34132 · Exploit
• 🔥 http://packetstormsecurity.com/files/127543/IBM-1754-GCM-KVM-Code-Execution-File-Read-XSS.html · Exploit
• 🔥 http://exploit-db.com/exploits/34132 · Exploit
• http://ibm.com/support/entry/portal/docdisplay?lndocid=migr-5095983 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-3085 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/94091 · Nota