PT-2025-41460 · Avtech · Avtech Devices

Published 2016-10-11 · Updated 2025-10-09 · CVE-2016-15047

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions AVTECH devices (affected versions not specified)

Description AVTECH devices that include the CloudSetup.cgi management endpoint are susceptible to authenticated OS command injection. The exefile parameter within the ''CloudSetup.cgi'' endpoint is passed to the underlying system command execution without sufficient validation or whitelisting. An authenticated attacker capable of invoking this endpoint can provide crafted input to execute arbitrary system commands as root. Successful exploitation can grant full control of the device, potentially enabling credential theft, lateral movement, or data exfiltration, depending on the deployment and network access of the device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2026-00076

CVE-2016-15047

Affected Products

Avtech Devices

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2016-15047 · Security Note
• https://bdu.fstec.ru/vul/2026-00076 · Security Note
• https://trendmicro.com/en_us/research/17/c/new-linux-malware-exploits-cgi-vulnerability.html · Note
• https://web.archive.org/web/20170420145806/http://search-lab.hu/media/vulnerability_matrix.txt · Note
• https://vulncheck.com/advisories/avtech-cloudsetup-cgi-auth-command-injection · Note
• https://exploit-db.com/exploits/40500 · Note
• https://t.me/cveNotify/138077 · Telegram Post
• https://sonicwall.com/blog/attackers-actively-targeting-vulnerable-avtech-devices · Note
• https://web.archive.org/web/20240810225729/https://search-lab.hu/advisories/126-AVTech-devices-multiple-vulnerabilities · Note