PT-2019-7933 · Mersive · Solstice Pod

Alexandre Teyar · Published 2019-11-27 · Updated 2019-12-04 · CVE-2017-12945

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Solstice Pod versions prior to 2.8.4

Description The issue is related to insufficient validation of user-supplied input for the networking configuration, which allows authenticated attackers to execute arbitrary commands as root.

Recommendations For versions prior to 2.8.4, update to version 2.8.4 or later to resolve the issue.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2017-12945

Affected Products

Solstice Pod

References · 6

• 🔥 https://github.com/aress31/cve-2017-12945 · Exploit
• 🔥 https://exploit-db.com/exploits/47722 · Exploit
• 🔥 http://packetstormsecurity.com/files/155494/Mersive-Solstice-2.8.0-Remote-Code-Execution.html · Exploit
• https://osv.dev/vulnerability/CVE-2017-12945 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-12945 · Security Note
• https://documentation.mersive.com/content/pages/release-notes.htm · Vendor Advisory