CVE-2024-26260: Hgiga OAKlouds - Command Injection

Description

The functionality for synchronization in HGiga OAKlouds' certain moudules has an OS Command Injection vulnerability, allowing remote attackers to inject system commands within specific request parameters. This enables the execution of arbitrary code on the remote server without permission.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.6% · higher than 76% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

OA

OAKlouds · Hgiga

earlier before 188; earlier before 1051 · source: vendor, CISA

OA

Oaklouds-organization-2.0 · Hgiga

before 188 · source: NVD

OA

Oaklouds-organization-3.0 · Hgiga

before 188 · source: NVD

OA

Oaklouds-webbase-2.0 · Hgiga

before 1051 · source: NVD

OA

Oaklouds-webbase-3.0 · Hgiga

before 1051 · source: NVD