RCE in IBM Global Console Manager 16 Firmware
CVE-2014-3085
systest.php on IBM GCM16 and GCM32 Global Console Manager switches with firmware before 1.20.20.23447 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the lpres parameter.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.076 (93.9th percentile) — read the EPSS interpretation.
Affected products
Weakness classification (CWE)
References
- psirt@us.ibm.com (Exploit, x_refsource_MISC)
- psirt@us.ibm.com (Exploit, exploit, x_refsource_EXPLOIT-DB)
- psirt@us.ibm.com (x_refsource_CONFIRM, Vendor Advisory)
- psirt@us.ibm.com (vdb-entry, x_refsource_XF)