CVE-2016-0861

General Electric (GE) Industrial Solutions UPS SNMP/Web Adapter devices with firmware before 4.8 allow remote authenticated users to execute arbitrary commands via unspecified vectors.
Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
icscertCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 92%
VendorProductVersion
geups_snmp_web_adapter_firmware
𝑥
≤ 4.7
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://apps.geindustrial.com/publibrary/checkout/Application%20and%20Technical%7CGEIS_SNMP%7CPDF&filename=GEIS_SNMP.pdf
http://packetstormsecurity.com/files/135586/GE-Industrial-Solutions-UPS-SNMP-Adapter-Command-Injection.html
http://seclists.org/fulldisclosure/2016/Feb/21
https://ics-cert.us-cert.gov/advisories/ICSA-16-033-02
https://www.exploit-db.com/exploits/39408/
http://apps.geindustrial.com/publibrary/checkout/Application%20and%20Technical%7CGEIS_SNMP%7CPDF&filename=GEIS_SNMP.pdf
http://packetstormsecurity.com/files/135586/GE-Industrial-Solutions-UPS-SNMP-Adapter-Command-Injection.html
http://seclists.org/fulldisclosure/2016/Feb/21
https://ics-cert.us-cert.gov/advisories/ICSA-16-033-02
https://www.exploit-db.com/exploits/39408/