| Titolo | OpenSpug spug 3.4.0 Command Injection |
|---|
| Descrizione | Spug is an open-source lightweight O&M platform for SMEs with numerous Internet deployments. In OpenSpug Spug v3.4.0 and earlier, the /exec/transfer/ endpoint does not properly validate user-supplied parameters, leading to OS command injection. A low-privileged authenticated user (File Transfer permission only) can execute arbitrary commands on the Spug server and, bypassing host authorization, on unauthorized managed hosts, fully compromising the Spug server and all hosts it manages. |
|---|
| Fonte | ⚠️ https://github.com/SECWG/CVE/issues/10 |
|---|
| Utente | WenGui (UID 82184) |
|---|
| Sottomissione | 26/08/2026 14:54 (2 mesi fa) |
|---|
| Moderazione | 10/10/2026 15:23 (2 months later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 416195 [OpenSpug fino a 3.4.0/4.0.1 File Transfer /exec/transfer escalationi di privilegi] |
|---|
| Punti | 20 |
|---|