Description (CNA)
Airleader Master versions 6.381 and prior allow for file uploads without restriction to multiple webpages running maximum privileges. This could allow an unauthenticated user to potentially obtain remote code execution on the server.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Airleader GmbH / Airleader Master | affected 0 through 6.381 |
CWE
CWE-434
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-043-10
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-043-10.json
- https://airleader.us/contact/
- https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-044.txt
ADP enrichment
No English description supplied.
No references supplied.