CVE-2017-2738
CriticalSummary
VCM5010 with software versions earlier than V100R002C50SPC100 has an authentication bypass vulnerability and an arbitrary file upload vulnerability. An unauthenticated attacker can bypass the login process, while an authenticated attacker can upload unvalidated files to the system.
Risk Assessment
This vulnerability poses a significant security risk to the system, allowing attackers to gain access to resources and potentially introduce malicious software.
Recommendation
It is recommended to update the software to version V100R002C50SPC100 or later and to implement additional security measures to prevent unauthorized access and file uploads.
Other vulnerabilities in VCM5010
See all- CVE-2017-2737High
VCM5010 with software versions earlier than V100R002C50SPC100 has an arbitrary file upload vulnerability. The software does not validate the uploaded files, allowing an authenticated attacker to upload arbitrary files to the system.
- CVE-2017-2736High
VCM5010 with software versions earlier than V100R002C50SPC100 has a command injection vulnerability. This is due to insufficient validation of user input.
Original NVD description (English source)
VCM5010 with software versions earlier before V100R002C50SPC100 has an authentication bypass vulnerability. This is due to improper implementation of authentication for accessing web pages. An unauthenticated attacker could bypass the authentication by sending a crafted HTTP request. 5010 with software versions earlier before V100R002C50SPC100 has an arbitrary file upload vulnerability. The software does not validate the files that uploaded. An authenticated attacker could upload arbitrary files to the system.