CVE-2020-2509
Command Injection Vulnerability in QTS and QuTS hero
In short
A flaw in QTS and QuTS hero operating systems allows attackers to run unauthorized commands on affected devices. This is a critical issue because it can give attackers complete control over the system.
Technical detail
Command injection vulnerability in QTS and QuTS hero allows unauthenticated or authenticated attackers to execute arbitrary operating system commands through insufficient input validation in application parameters. Successful exploitation results in complete system compromise with unrestricted code execution.
Summary generated and translated by AI from the official description.
A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 Build 20210202 and later QTS 4.5.1.1495 Build 20201123 and later QTS 4.3.6.1620 Build 20210322 and later QTS 4.3.4.1632 Build 20210324 and later QTS 4.3.3.1624 Build 20210416 and later QTS 4.2.6 Build 20210327 and later QuTS hero h4.5.1.1491 build 20201119 and later
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
public PoCs found — 1
githubgithub.com/jbaines-r7/overkill★ 14⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →