Common vulnerabilities and Exposures (CVE)

Skip to main content

Required CVE Record Information

Description

The configuration backup/restore function in Silver Peak Unity ECOSTM (ECOS) appliance software was found to directly incorporate the user-controlled config filename in a subsequent shell command, allowing an attacker to manipulate the resulting command by injecting valid OS command input. This vulnerability can be exploited by an attacker with authenticated access to the Orchestrator UI or EdgeConnect UI. This affects all ECOS versions prior to: 8.1.9.15, 8.3.0.8, 8.3.1.2, 8.3.2.0, 9.0.2.0, and 9.1.0.0.

CVSS 1 Total

Learn more
ScoreSeverityVersionVector String
6.8MEDIUM3.1CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Product Status

Learn more

Versions 6 Total

Default Status: unknown

affected

  • affected at All current ECOS versions prior to 8.1.9.15 
  • affected at 8.3.0.8 
  • affected at 8.3.1.2 
  • affected at 8.3.2.0 
  • affected at 9.0.2.0 
  • affected at and 9.1.0.0 

Credits

  • This vulnerability was reported to Silver Peak by Alexander Smye and Jonathan Letham from the security team at NCC Group.

Updated:

This container includes required additional information provided by the CVE Program for this vulnerability.