Visual Tools DVR Shellshock RCE (CVE-2021-42071)

Exploits CVE-2021-42071 in Visual Tools DVR VX16: Shellshock in User-Agent on /cgi-bin/slogin/login.py yields unauthenticated command execution. !/usr/bin/env python3 -- coding: utf-8 -- """Visual Tools DVR Shellshock RCE CVE-2021-42071.""" import re from kittysploit import from...

Visual Tools DVR VX16 4.2.28.0 - Unauthenticated OS Command Injection Detection

Visual Tools DVR VX16 4.2.28.0 could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. !/usr/bin/env python3 -- coding: utf-8 -- """Visual Tools DVR VX16 4.""" import re from kittysploit import from lib.protocols.http.httpclient import...

Ax-Solutions Visual Tools Dvr Vx16 security vulnerabilities

Ax-Solutions Visual Tools Dvr Vx16 is a video monitoring system developed by the American company Ax-Solutions. It is used for image analysis. The version 4.2.28 of Ax-Solutions Visual Tools Dvr Vx16 contains a security vulnerability, which stems from improper configuration of the sudo command...

CVE-2021-47799: Incorrect Privilege Assignment

Visual Tools DVR VX16 version 4.2.28 contains a local privilege escalation vulnerability in its Sudo configuration that allows attackers to gain root access. Attackers can exploit the unsafe Sudo settings by using mount commands to bind a shell, enabling unauthorized system-level privileges...

Command injection

In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker can achieve remote command execution via shell metacharacters in the cgi-bin/slogin/login.py User-Agent HTTP header...

CVE-2021-42071

In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker can achieve remote command execution via shell metacharacters in the cgi-bin/slogin/login.py User-Agent HTTP header...

PT-2021-23503

Name of the Vulnerable Software and Affected Versions Visual Tools DVR VX16 version 4.2.28.0 Description An unauthenticated attacker can achieve remote command execution via shell metacharacters in the "cgi-bin/slogin/login.py" API endpoint, specifically in the User-Agent HTTP header...

CVE-2021-42071: Improper Neutralization of Special Elements used in an OS Command

In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker can achieve remote command execution via shell metacharacters in the cgi-bin/slogin/login.py User-Agent HTTP header...

Visual Tools DVR VX16 4.2.28.0 - OS Command Injection (Unauthenticated) Vulnerability

Exploit Title: Visual Tools DVR VX16 4.2.28.0 - OS Command Injection Unauthenticated Exploit Author: Andrea D'Ubaldo Vendor Homepage: https://visual-tools.com/ Version: Visual Tools VX16 v4.2.28.0 Tested on: VX16 Embedded Linux 2.6.35.4. An unauthenticated remote attacker can inject arbitrary...

Visual Tools DVR VX16 4.2.28 - Local Privilege Escalation

Exploit Title: Visual Tools DVR VX16 4.2.28 - Local Privilege Escalation Date: 2021-07-05 Exploit Author: Andrea D'Ubaldo Vendor Homepage: https://visual-tools.com/ Version: Visual Tools VX16 v4.2.28.0 Tested on: VX16 Embedded Linux 2.6.35.4. An attacker can perform a system-level root local...