CVE-2018-6941

EUVD-2018-18685
A /shell?cmd= CSRF issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remote Code Execution in conjunction with XSS.
CSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 85%
Affected Products (NVD)
VendorProductVersion
nat32nat32
2.2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://hyp3rlinx.altervista.org/advisories/NAT32-REMOTE-COMMAND-EXECUTION-CSRF-CVE-2018-6941.txt
http://packetstormsecurity.com/files/146402/NAT32-Build-22284-Remote-Command-Execution-CSRF.html
https://www.exploit-db.com/exploits/44034/
http://hyp3rlinx.altervista.org/advisories/NAT32-REMOTE-COMMAND-EXECUTION-CSRF-CVE-2018-6941.txt
http://packetstormsecurity.com/files/146402/NAT32-Build-22284-Remote-Command-Execution-CSRF.html
https://www.exploit-db.com/exploits/44034/