CVE-2018-18879

In firmware version MS_2.6.9900 of Columbia Weather MicroServer, an authenticated web user can pipe commands directly to the underlying operating system as user input is not sanitized in networkdiags.php.
Code Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 62%
Common Weakness Enumeration
References
https://applied-risk.com/labs/advisories
https://ics-cert.us-cert.gov/advisories/ICSA-19-078-02
https://applied-risk.com/labs/advisories
https://ics-cert.us-cert.gov/advisories/ICSA-19-078-02