RCE in Thecus N8800 Nas Server
CVE-2013-5667
The Thecus NAS server N8800 with firmware 5.03.01 allows remote attackers to execute arbitrary commands via a get_userid action with shell metacharacters in the username parameter.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.042 (89.8th percentile) — read the EPSS interpretation.
Affected products
- Thecus N8800_nas_server
- Thecus N8800_nas_server_firmware — versions 5.03.01
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Exploit, x_refsource_MISC)
- cve@mitre.org (Exploit, x_refsource_MISC)
- cve@mitre.org (US Government Resource, x_refsource_CERT-VN, third-party-advisory)