CVE-2007-6182
HighSummary
Program responder w ISPsystem ISPmanager (znanym również jako ISPmgr) w wersji 4.2.15.1 umożliwia lokalnym użytkownikom uzyskanie podwyższonych uprawnień poprzez wykorzystanie metaznaków powłoki w argumentach wiersza poleceń.
Risk Assessment
Wykorzystanie tej podatności może prowadzić do nieautoryzowanego dostępu do systemu oraz potencjalnego przejęcia kontroli nad nim przez lokalnych użytkowników.
Recommendation
Zaleca się aktualizację ISPmanager do najnowszej wersji, aby zniwelować ryzyko związane z tą podatnością oraz ograniczenie dostępu do programu tylko dla zaufanych użytkowników.
Related vulnerabilities
- CVE-2026-87827Critical
Certain KGUARD DVR devices running vulnerable firmware expose a system command execution service on all network interfaces without requiring authentication. A remote unauthenticated attacker can execute arbitrary system commands, potentially leading to complete compromise. Exploited by Mirai_ptea and Mirai_aurora botnets for malware propagation and DDoS.
- CVE-2026-85978Critical
An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform. A path normalization discrepancy allows authentication bypass and access to an endpoint that executes attacker-supplied script code without sandboxing, leading to arbitrary code execution.
- CVE-2026-79696Critical
A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit (ADK) for Python versions 2.0.0 through 2.6.0 on Python (OSS), Cloud Run, and GKE environments where pytest is installed allows an unauthenticated remote attacker to execute arbitrary code using a crafted test session replay.
- CVE-2026-16272Critical
Use of less trusted source vulnerability in PayTR Virtual Pos iFrame API (v9x) WHMCS Module allows Exploitation of Trusted Identifiers. This issue affects versions from v9.0.0 before v9.0.3.
- CVE-2026-21102Critical
Use-after-free vulnerability in DualDAR prior to SMR Sep-2026 Release 1 allows local privileged attackers to execute arbitrary code with root privilege.
- CVE-2026-21096Critical
Heap-based buffer overflow in JPEG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbitrary code.
- CVE-2026-21095Critical
Heap-based buffer overflow in DNG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbitrary code.
- CVE-2026-87654Critical
Buffer overflow in ANGLE in Google Chrome on Windows prior to 153.0.8010.36. A remote attacker could execute arbitrary code outside the sandbox via a crafted HTML page.
- CVE-2026-87650Critical
Out-of-bounds read in WebGL in Google Chrome prior to 153.0.8010.36. A remote attacker could potentially execute arbitrary code outside the sandbox via a crafted HTML page.
- CVE-2026-87646Critical
Use after free in Web Authentication in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.
Original NVD description (English source)
The responder program in ISPsystem ISPmanager (aka ISPmgr) 4.2.15.1 allows local users to gain privileges via shell metacharacters in command line arguments.