A SQL injection vulnerability in Zultys MX-SE, MX-SE II, MX-E, MX-Virtual, MX250, and MX30 with firmware versions before 17.0.10 patch 17161 and 16.04 patch 16109 allows an authenticated malicious user to execute arbitrary SQL queries on the backend database via the filter parameter in requests to the /newapi/ endpoint in the Zultys MX web interface.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
zultys mx-se_firmware |
||
zultys mx-se_ii_firmware |
||
zultys mx-e_firmware |
||
zultys mx-virtual_firmware |
||
zultys mx250_firmware |
||
zultys mx30_firmware |
Vulmon