CVE-2019-17059

EUVD-2019-7531
A shell injection vulnerability on the Sophos Cyberoam firewall appliance with CyberoamOS before 10.6.6 MR-6 allows remote attackers to execute arbitrary commands via the Web Admin and SSL VPN consoles.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 90%
Affected Products (NVD)
VendorProductVersion
sophoscyberoamos
𝑥
< 10.6.6
sophoscyberoamos
10.6.6
sophoscyberoamos
10.6.6:maintenance_release1
sophoscyberoamos
10.6.6:maintenance_release2
sophoscyberoamos
10.6.6:maintenance_release3
sophoscyberoamos
10.6.6:maintenance_release4
sophoscyberoamos
10.6.6:maintenance_release5
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://community.sophos.com/kb/en-us/134732
https://community.sophos.com/products/cyberoamos/
https://thebestvpn.com/cyberoam-preauth-rce/
https://community.sophos.com/kb/en-us/134732
https://community.sophos.com/products/cyberoamos/
https://thebestvpn.com/cyberoam-preauth-rce/