Unscored severity · published Oct 28, 2015
CVE-2015-7901
Infinite Automation Mango Automation 2.5.x and 2.6.x through 2.6.0 build 430 allows remote authenticated users to execute arbitrary OS commands via unspecified vectors
–
CVSS
3.3%
EPSS
No
On KEV
Description
Infinite Automation Mango Automation 2.5.x and 2.6.x through 2.6.0 build 430 allows remote authenticated users to execute arbitrary OS commands via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.3% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Mango Automation · Infinite Automation Systems
2.5.0; 2.5.5; 2.6.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-7901
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-7901
Patch
https://ics-cert.us-cert.gov/advisories/ICSA-15-300-02
www.exploit-db.com
https://www.exploit-db.com/exploits/42698/
More from Mango Automation
–
CVE-2015-7904
Unrestricted file upload vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authenticated users to execute arbitrary JSP…
–
CVE-2015-7903
SQL injection vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authenticated users to execute arbitrary SQL commands via…
–
CVE-2015-7902
Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 provides different error messages for failed login attempts in unspecified circumstances, which allows…
–
CVE-2015-7900
Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote attackers to obtain sensitive debugging information by entering a crafted URL to trigger…
–
CVE-2015-6494
Cross-site scripting (XSS) vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authenticated users to inject arbitrary web…