PT-2012-4141 · Plixer · Plixer Scrutinizer

Published 2012-07-31 · Updated 2018-03-12 · CVE-2012-2627

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) versions prior to 9.5.0

Description The issue allows remote attackers to create or overwrite arbitrary files in the %PROGRAMFILES%Scrutinizersnmpmibs directory via a multipart/form-data POST request to the d4d/uploader.php file in the web console.

Recommendations For versions prior to 9.5.0, update to version 9.5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the d4d/uploader.php file in the web console until a patch is applied.

Exploit

Fix

Related Identifiers

CVE-2012-2627

Affected Products

Plixer Scrutinizer

References · 5

• 🔥 https://exploit-db.com/exploits/37548 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-2627 · Security Note
• http://plixer.com/Press-Releases/plixer-releases-9-5-2.html · Note
• https://trustwave.com/spiderlabs/advisories/TWSL2012-014.txt · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2627 · Note