CVE-2017-2736
HighSummary
VCM5010 with software versions earlier than V100R002C50SPC100 has a command injection vulnerability. This is due to insufficient validation of user input.
Risk Assessment
The risk is that an authenticated attacker could launch a command injection attack, potentially leading to unauthorized access to the system.
Recommendation
It is recommended to update the software to version V100R002C50SPC100 or later to mitigate this vulnerability.
Other vulnerabilities in VCM5010
See all- CVE-2017-2737High
VCM5010 with software versions earlier than V100R002C50SPC100 has an arbitrary file upload vulnerability. The software does not validate the uploaded files, allowing an authenticated attacker to upload arbitrary files to the system.
- CVE-2017-2738Critical
VCM5010 with software versions earlier than V100R002C50SPC100 has an authentication bypass vulnerability and an arbitrary file upload vulnerability. An unauthenticated attacker can bypass the login process, while an authenticated attacker can upload unvalidated files to the system.
Original NVD description (English source)
VCM5010 with software versions earlier before V100R002C50SPC100 has a command injection vulnerability. This is due to insufficient validation of user's input. An authenticated attacker could launch a command injection attack.