PT-2020-7948 · Akips · Akips Network Monitor

Brianwgray · Published 2020-01-06 · Updated 2020-01-14 · CVE-2016-11017

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: AKIPS Network Monitor versions 15.37 through 16.5

Description: The application login page allows a remote unauthenticated attacker to execute arbitrary OS commands via shell metacharacters in the username parameter. A failed login attempt returns the command-injection output to a limited login failure field.

Recommendations: For AKIPS Network Monitor versions 15.37 through 16.5, update to version 16.6 to resolve the issue. As a temporary workaround, consider restricting access to the login page or avoiding the use of special characters in the username parameter until the update is applied.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2016-11017

Affected Products

Akips Network Monitor

References · 4

• 🔥 https://exploit-db.com/exploits/39564 · Exploit
• 🔥 https://ctrlu.net/vuln/0002.html · Exploit
• https://osv.dev/vulnerability/CVE-2016-11017 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-11017 · Security Note