Description (CNA)
AirControl 1.4.2 contains a pre-authentication remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary system commands through malicious Java expression injection. Attackers can exploit the /.seam endpoint by crafting a specially constructed URL with embedded Java expressions to run commands with the application's system privileges.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Ubiquiti, Inc. / AirControl | affected <= 1.4.2 |
CWE
CWE-94
References
- https://www.exploit-db.com/exploits/48541
- https://www.ui.com/
- https://www.vulncheck.com/advisories/aircontrol-preauth-remote-code-execution
ADP enrichment
No English description supplied.
No references supplied.