CVE-2015-2279

Critical

Published: 25/07/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The cgi_test.cgi in AirLive devices BU-2015, BU-3026, and MD-3025 has a vulnerability that allows remote attackers to execute arbitrary OS commands via shell metacharacters after an '&' in specific parameters.

Risk Assessment

Attackers could gain full control over the system, potentially leading to serious security breaches and data loss.

Recommendation

It is recommended to update the firmware to the latest version to mitigate this vulnerability and restrict access to the cgi_test.cgi interface.

Original NVD description (English source)

cgi_test.cgi in AirLive BU-2015 with firmware 1.03.18, BU-3026 with firmware 1.43, and MD-3025 with firmware 1.81 allows remote attackers to execute arbitrary OS commands via shell metacharacters after an "&" (ampersand) in the write_mac write_pid, write_msn, write_tan, or write_hdv parameter.