PT-2026-30480 · Va Max · Va Max

Published 2026-04-05 · Updated 2026-04-05 · CVE-2019-25671

Mitre

CVSS v3.1

8.8

High

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

VA MAX 8.3.4 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands by injecting shell metacharacters into the mtu eth0 parameter. Attackers can send POST requests to the changeip.php endpoint with malicious payload in the mtu eth0 field to execute commands as the apache user.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-25671

Affected Products

Va Max

References · 3

• 🔥 https://exploit-db.com/exploits/46348 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25671 · Security Note
• https://vulncheck.com/advisories/va-max-remote-code-execution-via-changeip-php · Note