PT-2014-5076 · Ibm · Ibm Gcm16+1

Alejandro Alvarez Bravo · Published 2014-08-17 · Updated 2017-08-29 · CVE-2014-3085

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM GCM16 and GCM32 Global Console Manager switches with firmware before 1.20.20.23447

Description The issue allows remote authenticated users to execute arbitrary commands via shell metacharacters in the lpres parameter in the systest.php file.

Recommendations For IBM GCM16 and GCM32 Global Console Manager switches with firmware before 1.20.20.23447, update the firmware to version 1.20.20.23447 or later to resolve the issue. As a temporary workaround, consider restricting access to the systest.php file to minimize the risk of exploitation. Avoid using the lpres parameter in the affected file until the issue is resolved.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2014-3085

Affected Products

Ibm Gcm16

Ibm Gcm32

References · 6

• 🔥 https://exploit-db.com/exploits/34132 · Exploit
• 🔥 http://packetstormsecurity.com/files/127543/IBM-1754-GCM-KVM-Code-Execution-File-Read-XSS.html · Exploit
• 🔥 http://exploit-db.com/exploits/34132 · Exploit
• http://ibm.com/support/entry/portal/docdisplay?lndocid=migr-5095983 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3085 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/94091 · Note