PT-2026-30480 · Va Max · Va Max

CVE-2019-25671 · Published 2026-04-05 · Updated 2026-04-05

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VA MAX version 8.3.4

Description Authenticated attackers can achieve remote code execution by injecting shell metacharacters into the mtu eth0 parameter. This is possible by sending POST requests to the 'changeip.php' endpoint with a malicious payload in the mtu eth0 field, allowing the execution of arbitrary commands with the privileges of the apache user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the mtu eth0 parameter in the 'changeip.php' endpoint to minimize the risk of exploitation.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-25671

Affected Products

Va Max

References · 3

• 🔥 https://exploit-db.com/exploits/46348 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25671 · Security Note
• https://vulncheck.com/advisories/va-max-remote-code-execution-via-changeip-php · Note