Qvidium
Monthly
Command injection in QVidium Opera11 (firmware 3.3.2a26-Ax4x-opera11) lets remote attackers run arbitrary OS commands by manipulating the ipaddr argument of the /cgi-bin/net_tr.cgi CGI script. The flaw is remotely reachable without authentication and publicly available exploit code exists, but it is not listed in CISA KEV. Because QVidium has ceased operations, no fix will ever be issued, making every deployed unit permanently vulnerable.
The QVidium Opera11 device (firmware version 2.9.0-Ax4x-opera11) is vulnerable to Remote Code Execution (RCE) due to improper input validation on the /cgi-bin/net_ping.cgi endpoint. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Command injection in QVidium Opera11 (firmware 3.3.2a26-Ax4x-opera11) lets remote attackers run arbitrary OS commands by manipulating the ipaddr argument of the /cgi-bin/net_tr.cgi CGI script. The flaw is remotely reachable without authentication and publicly available exploit code exists, but it is not listed in CISA KEV. Because QVidium has ceased operations, no fix will ever be issued, making every deployed unit permanently vulnerable.
The QVidium Opera11 device (firmware version 2.9.0-Ax4x-opera11) is vulnerable to Remote Code Execution (RCE) due to improper input validation on the /cgi-bin/net_ping.cgi endpoint. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.