CVE-2016-0861

EUVD-2016-0872
General Electric (GE) Industrial Solutions UPS SNMP/Web Adapter devices with firmware before 4.8 allow remote authenticated users to execute arbitrary commands via unspecified vectors.
Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 92%
Affected Products (NVD)
VendorProductVersion
geups_snmp_web_adapter_firmware
𝑥
≤ 4.7
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://apps.geindustrial.com/publibrary/checkout/Application%20and%20Technical%7CGEIS_SNMP%7CPDF&filename=GEIS_SNMP.pdf
http://packetstormsecurity.com/files/135586/GE-Industrial-Solutions-UPS-SNMP-Adapter-Command-Injection.html
http://seclists.org/fulldisclosure/2016/Feb/21
https://ics-cert.us-cert.gov/advisories/ICSA-16-033-02
https://www.exploit-db.com/exploits/39408/
http://apps.geindustrial.com/publibrary/checkout/Application%20and%20Technical%7CGEIS_SNMP%7CPDF&filename=GEIS_SNMP.pdf
http://packetstormsecurity.com/files/135586/GE-Industrial-Solutions-UPS-SNMP-Adapter-Command-Injection.html
http://seclists.org/fulldisclosure/2016/Feb/21
https://ics-cert.us-cert.gov/advisories/ICSA-16-033-02
https://www.exploit-db.com/exploits/39408/