CVE-2025-57457

CURO UC300 IP电话中的操作系统命令注入 Curo UC300 5.42.1.7.1.63R1 管理面板中存在一个操作系统命令注入漏洞，允许本地攻击者通过“IP Addr”参数注入任意操作系统命令。 PoC: https://github.com/restdone/CVE-2025-57457/blob/main/oscommandinject.mp4 步骤 1. 登录 UC300 的管理面板（电话 IP 和端口 80） 2. 浏览至“网络”，然后选择“诊断” 3. 在“IP Addr”字段中注入操作系统命令 4. 点击“开始”并在电话上执行 Linux 命令 时间线...

CVE-2025-57457

An OS Command Injection vulnerability in the Admin panel in Curo UC300 5.42.1.7.1.63R1 allows local attackers to inject arbitrary OS Commands via the "IP Addr" parameter...

CVE-2025-57457

An OS Command Injection vulnerability in the Admin panel in Curo UC300 5.42.1.7.1.63R1 allows local attackers to inject arbitrary OS Commands via the "IP Addr" parameter...

CVE-2025-57457

An OS Command Injection vulnerability in the Admin panel in Curo UC300 5.42.1.7.1.63R1 allows local attackers to inject arbitrary OS Commands via the "IP Addr" parameter...

CVE-2025-57457

An OS Command Injection vulnerability in the Admin panel in Curo UC300 5.42.1.7.1.63R1 allows local attackers to inject arbitrary OS Commands via the "IP Addr" parameter...

EUVD-2025-33285

An OS Command Injection vulnerability in the Admin panel in Curo UC300 5.42.1.7.1.63R1 allows local attackers to inject arbitrary OS Commands via the "IP Addr" parameter...

CVE-2025-57457

CVE-2025-57457 affects Curo UC300 (5.42.1.7.1.63R1). The Admin panel exposes an OS command injection via the IP Addr parameter, enabling local attackers to inject arbitrary OS commands. Root cause is unvalidated/unsanitized input in the IP Addr field. Impact is high: potential confidentiality, in...