Vulnerability-Lookup

CNVD-2019-09276

Vulnerability from cnvd - Published: 2019-04-04

Title

NetGain Enterprise Manager OS命令注入漏洞

Description

NetGain Enterprise Manager（简称EM），是NetGain Systems所研发的一款即插即用的硬件IT架构监测管理设备。 10.0.57之前的NetGain Enterprise Manager (EM)存在OS命令注入漏洞，远程认证攻击者可利用该漏洞注入任意代码，从而可实现远程代码执行。

Severity

高

Patch Name

NetGain Enterprise Manager OS命令注入漏洞的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： http://www.netgain-systems.com/netgain-enterprise-manager/

Reference

https://nvd.nist.gov/vuln/detail/CVE-2018-10587

Impacted products

Name
NetGain Systems Netgain Enterprise Manager <10.0.57

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-10587"
    }
  },
  "description": "NetGain Enterprise Manager\uff08\u7b80\u79f0EM\uff09\uff0c\u662fNetGain Systems\u6240\u7814\u53d1\u7684\u4e00\u6b3e\u5373\u63d2\u5373\u7528\u7684\u786c\u4ef6IT\u67b6\u6784\u76d1\u6d4b\u7ba1\u7406\u8bbe\u5907\u3002\n\n10.0.57\u4e4b\u524d\u7684NetGain Enterprise Manager (EM)\u5b58\u5728OS\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\uff0c\u8fdc\u7a0b\u8ba4\u8bc1\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6ce8\u5165\u4efb\u610f\u4ee3\u7801\uff0c\u4ece\u800c\u53ef\u5b9e\u73b0\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u3002",
  "discovererName": "Enrico Winata, Security Researcher \u0026 Penetration Tester @wizlynx group - Tan Peng Fei Eddie, Security Researcher \u0026 Penetration Tester @wizlynx group",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttp://www.netgain-systems.com/netgain-enterprise-manager/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-09276",
  "openTime": "2019-04-04",
  "patchDescription": "NetGain Enterprise Manager\uff08\u7b80\u79f0EM\uff09\uff0c\u662fNetGain Systems\u6240\u7814\u53d1\u7684\u4e00\u6b3e\u5373\u63d2\u5373\u7528\u7684\u786c\u4ef6IT\u67b6\u6784\u76d1\u6d4b\u7ba1\u7406\u8bbe\u5907\u3002\r\n\r\n10.0.57\u4e4b\u524d\u7684NetGain Enterprise Manager (EM)\u5b58\u5728OS\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\uff0c\u8fdc\u7a0b\u8ba4\u8bc1\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6ce8\u5165\u4efb\u610f\u4ee3\u7801\uff0c\u4ece\u800c\u53ef\u5b9e\u73b0\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "NetGain Enterprise Manager OS\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "NetGain Systems Netgain Enterprise Manager \u003c10.0.57"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2018-10587",
  "serverity": "\u9ad8",
  "submitTime": "2018-11-02",
  "title": "NetGain Enterprise Manager OS\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e"
}

CVE-2018-10587 (GCVE-0-2018-10587)

Vulnerability from cvelistv5 – Published: 2018-11-01 17:00 – Updated: 2024-08-05 07:39

Summary

NetGain Enterprise Manager (EM) is affected by OS Command Injection vulnerabilities in versions before 10.0.57. These vulnerabilities could allow remote authenticated attackers to inject arbitrary code, resulting in remote code execution.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

https://www.wizlynxgroup.com/security-research-ad…

x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T07:39:08.450Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2018-004"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-04-30T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "NetGain Enterprise Manager (EM) is affected by OS Command Injection vulnerabilities in versions before 10.0.57. These vulnerabilities could allow remote authenticated attackers to inject arbitrary code, resulting in remote code execution."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-11-01T16:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2018-004"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-10587",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "NetGain Enterprise Manager (EM) is affected by OS Command Injection vulnerabilities in versions before 10.0.57. These vulnerabilities could allow remote authenticated attackers to inject arbitrary code, resulting in remote code execution."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2018-004",
              "refsource": "MISC",
              "url": "https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2018-004"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-10587",
    "datePublished": "2018-11-01T17:00:00",
    "dateReserved": "2018-05-01T00:00:00",
    "dateUpdated": "2024-08-05T07:39:08.450Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2019-09276

CVE-2018-10587 (GCVE-0-2018-10587)

Tags

Sightings

Nomenclature