CVE-2019-5446 - OpenCVE

Command Injection in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to execute commands as root.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

AV:N/AC:L/Au:S/C:C/I:C/A:C

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Ui	Edgeswitch Firmware Ep-s16. Es-12f Es-16-150w Es-16-xg Es-24-250w Es-24-500w Es-24-lite Es-48-500w Es-48-750w Es-48-lite Es-8-150w

Configuration 1 [-]

AND

cpe:2.3:o:ui:edgeswitch_firmware:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:ui:ep-s16.:-:::::::*
	cpe:2.3:h:ui:es-12f:-:::::::*
	cpe:2.3:h:ui:es-16-150w:-:::::::*
	cpe:2.3:h:ui:es-16-xg:-:::::::*
	cpe:2.3:h:ui:es-24-250w:-:::::::*
	cpe:2.3:h:ui:es-24-500w:-:::::::*
	cpe:2.3:h:ui:es-24-lite:-:::::::*
	cpe:2.3:h:ui:es-48-500w:-:::::::*
	cpe:2.3:h:ui:es-48-750w:-:::::::*
	cpe:2.3:h:ui:es-48-lite:-:::::::*
	cpe:2.3:h:ui:es-8-150w:-:::::::*

No data.

References

Link	Providers
https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7

History

No history.

MITRE

Status: PUBLISHED

Assigner: hackerone

Published: 2019-07-10T19:47:07

Updated: 2024-08-04T19:54:53.484Z

Reserved: 2019-01-04T00:00:00

Link: CVE-2019-5446

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2019-07-10T20:15:12.763

Modified: 2023-02-02T22:19:09.107

Link: CVE-2019-5446

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "EdgeMAX", "vendor": "n/a", "versions": [{"status": "affected", "version": "1.8.1"}]}], "descriptions": [{"lang": "en", "value": "Command Injection in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to execute commands as root."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-77", "description": "Command Injection - Generic (CWE-77)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2019-07-10T19:47:07", "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "support@hackerone.com", "ID": "CVE-2019-5446", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "EdgeMAX", "version": {"version_data": [{"version_value": "1.8.1"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Command Injection in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to execute commands as root."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Command Injection - Generic (CWE-77)"}]}]}, "references": {"reference_data": [{"name": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7", "refsource": "MISC", "url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T19:54:53.484Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7"}]}]}, "cveMetadata": {"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "assignerShortName": "hackerone", "cveId": "CVE-2019-5446", "datePublished": "2019-07-10T19:47:07", "dateReserved": "2019-01-04T00:00:00", "dateUpdated": "2024-08-04T19:54:53.484Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ui:edgeswitch_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "CB6F9B35-509E-4380-A473-796E32BCA88B", "versionEndExcluding": "1.8.2", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ui:ep-s16.:-:*:*:*:*:*:*:*", "matchCriteriaId": "8E496145-AC02-4EF5-8FE2-BF5593F89ABA", "vulnerable": false}, {"criteria": "cpe:2.3:h:ui:es-12f:-:*:*:*:*:*:*:*", "matchCriteriaId": "35E11BF8-2295-4DC3-B463-DC305B2ED456", "vulnerable": false}, {"criteria": "cpe:2.3:h:ui:es-16-150w:-:*:*:*:*:*:*:*", "matchCriteriaId": "AD4B5024-6E26-4011-9392-26E304C0B00C", "vulnerable": false}, {"criteria": "cpe:2.3:h:ui:es-16-xg:-:*:*:*:*:*:*:*", "matchCriteriaId": "82590A80-2DA6-4BA3-BAF9-DA6B9118C7E2", "vulnerable": false}, {"criteria": "cpe:2.3:h:ui:es-24-250w:-:*:*:*:*:*:*:*", "matchCriteriaId": "EBA2938D-8AF2-47D5-B881-AD27A999989D", "vulnerable": false}, {"criteria": "cpe:2.3:h:ui:es-24-500w:-:*:*:*:*:*:*:*", "matchCriteriaId": "2CDFD81A-C3D6-4B54-97C6-718FEB23C57C", "vulnerable": false}, {"criteria": "cpe:2.3:h:ui:es-24-lite:-:*:*:*:*:*:*:*", "matchCriteriaId": "0085DBEE-368A-400D-A2E7-AC090CCD6324", "vulnerable": false}, {"criteria": "cpe:2.3:h:ui:es-48-500w:-:*:*:*:*:*:*:*", "matchCriteriaId": "D7AC5ECE-A2E4-4AD8-B65D-4B5CFFF0A044", "vulnerable": false}, {"criteria": "cpe:2.3:h:ui:es-48-750w:-:*:*:*:*:*:*:*", "matchCriteriaId": "287F2ABB-2855-4938-A5F3-857744ABC4E6", "vulnerable": false}, {"criteria": "cpe:2.3:h:ui:es-48-lite:-:*:*:*:*:*:*:*", "matchCriteriaId": "0C8A7623-0F2F-49F3-81F4-515E29A907EF", "vulnerable": false}, {"criteria": "cpe:2.3:h:ui:es-8-150w:-:*:*:*:*:*:*:*", "matchCriteriaId": "CD0CDC1D-D5F7-437D-9544-95E8DBFBF1F7", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Command Injection in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to execute commands as root."}, {"lang": "es", "value": "Una Inyecci\u00f3n de Comandos en EdgeMAX EdgeSwitch versiones anteriores a 1.8.2, permite a un usuario administrador ejecutar comandos como root."}], "id": "CVE-2019-5446", "lastModified": "2023-02-02T22:19:09.107", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "COMPLETE", "baseScore": 9.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-07-10T20:15:12.763", "references": [{"source": "support@hackerone.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7"}], "sourceIdentifier": "support@hackerone.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-77"}], "source": "support@hackerone.com", "type": "Secondary"}]}