Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Epross AVCON6 OGNL Remote Code Execution via login.action
Vulnerability Description
Epross AVCON6 systems management platform contains an object-graph navigation language (OGNL) injection vulnerability that allows unauthenticated attackers to execute arbitrary commands by injecting malicious OGNL expressions. Attackers can send crafted requests to the login.action endpoint with OGNL payloads in the redirect parameter to instantiate ProcessBuilder objects and execute system commands with root privileges.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability Type
CWE-1334
Vulnerability Title
Epross AVCON6 安全漏洞
Vulnerability Description
Epross AVCON6是Epross公司的一个监控视频管理服务器。 Epross AVCON6存在安全漏洞，该漏洞源于OGNL注入，可能导致未经验证的攻击者执行任意命令。
CVSS Information
N/A
Vulnerability Type
N/A