Published: 25/07/2017 Updated: 09/10/2018

CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 1000

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

cgi_test.cgi in AirLive BU-2015 with firmware 1.03.18, BU-3026 with firmware 1.43, and MD-3025 with firmware 1.81 allows remote malicious users to execute arbitrary OS commands via shell metacharacters after an "&" (ampersand) in the write_mac write_pid, write_msn, write_tan, or write_hdv parameter.

Vulnerable Product	Search on Vulmon	Subscribe to Product
airlive bu-2015_firmware 1.03.18
airlive bu-3026_firmware 1.43
airlive md-3025_firmware 1.81

1 Advisory Information Title: AirLive Multiple Products OS Command Injection Advisory ID: CORE-2015-0012 Advisory URL: wwwcoresecuritycom/advisories/airlive-multiple-products-os-command-injection Date published: 2015-07-06 Date of last update: 2015-07-06 Vendors contacted: AirLive Release mode: User release 2 Vulnerability Information ...

Core Security Technologies Advisory - AirLive MD-3025, BU-3026, BU-2015, WL-2000CAM, and POE-200CAM are IP cameras designed for professional surveillance and security applications The built-in IR LEDs provide high quality nighttime monitoring These AirLive devices are vulnerable to an OS Command Injection Vulnerability In the case of the MD-3025 ...

CWE-78 https://www.exploit-db.com/exploits/37532/https://www.coresecurity.com/advisories/airlive-multiple-products-os-command-injection http://www.securityfocus.com/bid/75559 http://seclists.org/fulldisclosure/2015/Jul/29 http://packetstormsecurity.com/files/132585/AirLive-Remote-Command-Injection.html http://www.securityfocus.com/archive/1/535938/100/0/threaded https://nvd.nist.gov https://www.exploit-db.com/exploits/37532/

CVE-2015-2279

Vulnerability Summary

Vulnerability Trend

Exploits

References

Vulmon Search

About

Products

Connect