Avocent Acs8000
Monthly
Remote command injection in Vertiv Avocent ACS8000's root-privileged wsserver terminal-bridge daemon allows unauthenticated network attackers to execute shell commands by supplying crafted WebSocket fields that reach system() and popen() without quoting, escaping, or character-set validation. The public-key session path performs no appliance-session check, consistent with the CVSS PR:N vector, so the vulnerable command-construction path can be reached without an appliance authentication gate. No public exploit was identified at time of analysis; no CISA KEV entry or EPSS score is present in the supplied intelligence, and the vuln.today decision label is act_now.
Remote command injection in Vertiv Avocent ACS8000's root-privileged wsserver terminal-bridge daemon allows unauthenticated network attackers to execute shell commands by supplying crafted WebSocket fields that reach system() and popen() without quoting, escaping, or character-set validation. The public-key session path performs no appliance-session check, consistent with the CVSS PR:N vector, so the vulnerable command-construction path can be reached without an appliance authentication gate. No public exploit was identified at time of analysis; no CISA KEV entry or EPSS score is present in the supplied intelligence, and the vuln.today decision label is act_now.