CVE-2017-6079
CriticalSummary
The HTTP web-management application on Edgewater Networks Edgemarc appliances has a hidden page that allows for user-defined commands such as specific iptables routes. This page acts as a web shell, enabling command execution without client-side feedback from the web application.
Risk Assessment
Exploitation of this vulnerability could lead to unauthorized system access and execution of arbitrary commands, posing a significant security risk to the organization.
Recommendation
It is recommended to update the device firmware to the latest version to remove this hidden page and restrict access to management functions.
Original NVD description (English source)
The HTTP web-management application on Edgewater Networks Edgemarc appliances has a hidden page that allows for user-defined commands such as specific iptables routes, etc., to be set. You can use this page as a web shell essentially to execute commands, though you get no feedback client-side from the web application: if the command is valid, it executes. An example is the wget command. The page that allows this has been confirmed in firmware as old as 2006.