Comtrend · Comtrend Vr-3033 · CVE-2020-10173
**Name of the Vulnerable Software and Affected Versions**
Comtrend VR-3033 DE11-416SSG-C01 R02.A2pvI042j1.d26m
**Description**
The issue concerns Multiple Authenticated Command Injection vulnerabilities. These vulnerabilities can be exploited via the ping and traceroute diagnostic pages. Specifically, the `pingIpAddress` parameter to `ping.cgi` is vulnerable to shell metacharacters.
**Recommendations**
For Comtrend VR-3033 DE11-416SSG-C01 R02.A2pvI042j1.d26m, as a temporary workaround, consider restricting access to the ping and traceroute diagnostic pages until a patch is available. Avoid using the `pingIpAddress` parameter in the affected `ping.cgi` endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.