CVE-2016-2332
HighSummary
The web interface on SysLINK SL-1000 Machine-to-Machine (M2M) Modular Gateway devices with firmware before version 01A.8 has a vulnerability in the flu.cgi file that allows remote authenticated users to execute arbitrary commands via the 5066 (dnsmasq) parameter.
Risk Assessment
This vulnerability could lead to unauthorized access to the system and potential takeover of the device by remote users.
Recommendation
It is recommended to update the firmware to version 01A.8 or later to mitigate this vulnerability and to restrict access to the web interface only to trusted users.
Other vulnerabilities in SysLINK SL-1000 Machine-to-Machine (M2M) Modular Gateway
See all- CVE-2016-2333High
SysLINK SL-1000 Machine-to-Machine (M2M) Modular Gateway devices with firmware before version 01A.8 use the same hardcoded encryption key across different customers' installations, allowing attackers to defeat cryptographic protection mechanisms.
- CVE-2016-2331Critical
The web interface on SysLINK SL-1000 Machine-to-Machine (M2M) Modular Gateway devices with firmware before 01A.8 has a default password, which makes it easier for remote attackers to obtain access via unspecified vectors.
Original NVD description (English source)
flu.cgi in the web interface on SysLINK SL-1000 Machine-to-Machine (M2M) Modular Gateway devices with firmware before 01A.8 allows remote authenticated users to execute arbitrary commands via the 5066 (aka dnsmasq) parameter.