EUVD-2019-20077

VA MAX 8.3.4 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands by injecting shell metacharacters into the mtueth0 parameter. Attackers can send POST requests to the changeip.php endpoint with malicious payload in the mtueth0 field to...

CVE-2019-25671

CVE-2019-25671 affects VA MAX 8.3.4. A remote code execution vulnerability exists in the changeip.php endpoint, where an authenticated attacker can inject shell metacharacters in the mtu_eth0 parameter and trigger arbitrary commands as the apache user via a POST request. The issue is exploitable ...