Multiple AcTi product Web configuration program Shell Command Injection Vulnerability

Release date:

Updated on:

Affected Systems:

ACTi ACD-2100 Video Encoder

ACTi ACM-1432 Bullet Camera

Description:

--------------------------------------------------------------------------------

ACTi mainly produces, develops, and sells products and services such as IP monitoring, end-to-end solution development and integration, and business model.

The Web configuration program of multiple AcTi products has the Shell command injection vulnerability. Remote attackers can exploit this vulnerability to control the affected devices.

The input of the "iperf" parameter passed to cgi-bin/test on the Web Configurator management interface is not properly filtered when it is used for command line parameters. arbitrary shell commands can be injected.

<* Source: todordonev

Link: http://secunia.com/advisories/43812/

*>

Suggestion:

--------------------------------------------------------------------------------

Vendor patch:

ACTi

----

Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://www.acti.com/productsV2/Product_Category.Asp? StrCatalog_ID = 57803431-9E23-45A9-A1D8-81F13AC9D5