RCE in Ipcop

CVE-2013-7418

cgi-bin/iptablesgui.cgi in IPCop (aka IPCop Firewall) before 2.1.5 allows remote authenticated users to execute arbitrary code via shell metacharacters in the TABLE parameter. NOTE: this can be exploited remotely by leveraging a separate cross-site scripting (XSS) vulnerability.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.026 (83.8th percentile) — read the EPSS interpretation.

Affected products

  • Ipcop
  • N/a — versions n/a

Weakness classification (CWE)

References