CVE ID | CVE-2014-3789 |
CVSS SCORE | 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P |
AFFECTED VENDORS |
Cogent Real-Time Systems |
AFFECTED PRODUCTS |
Cogent Datahub |
VULNERABILITY DETAILS |
The specific flaw exists within the EvalExpresssion method, which is available remotely through the AJAX facility. Using this method, it is possible to execute arbitrary Gamma code. By supplying a specially formatted Gamma script, a remote attacker can execute arbitrary OS commands in the context of the DataHub process. |
ADDITIONAL DETAILS |
Cogent Real-Time Systems has issued an update to correct this vulnerability. More details can be found at:
https://ics-cert.us-cert.gov/advisories/ICSA-15-246-01 |
DISCLOSURE TIMELINE |
|
CREDIT | Anonymous |