CVE-2021-26471

CVE-2021-26471 affects VembuBDR (before 4.2.0.1) and VembuOffsiteDR (before 4.2.0.1). The http API at /sgwebservice_o.php accepts a command argument, enabling an unauthenticated attacker to execute arbitrary shell commands via command injection in the API. This is a network-accessible vulnerabili...

CVE-2021-26471 Unauthenticated remote command execution in Vembu products

In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1, the http API located at /sgwebserviceo.php accepts a command argument. Using this command argument an unauthenticated attacker can execute arbitrary shell commands...