CVE-2021-46704
CVE-2021-46704
This page contains facts from public vulnerability sources. Check the original advisory before updating.
In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument (lib/ui/api.ts and lib/ping.ts). The vulnerability arises from insufficient input validation combined with a missing authorization check.
CVSS 9.8 · Critical · EPSS 21.9% · Public exploit · Fix available
- Published
- Updated
Stack: node