Siteguard Server Edition For Iis
Monthly
OS command injection in EG Secure Solutions' SiteGuard Server Edition allows an attacker who already holds a low-privilege account or foothold on the host to execute arbitrary OS commands as root (Apache httpd/nginx on Linux or FreeBSD) or SYSTEM (IIS on Windows), achieving full compromise of the affected server. The CVSS 4.0 base score of 8.5 reflects a local attack vector (AV:L) with low privileges (PR:L), no user interaction (UI:N), low complexity (AC:L), and high confidentiality, integrity, and availability impact confined to the vulnerable system (VC:H/VI:H/VA:H, SC:N/SI:N/SA:N) - it is not remotely exploitable by an anonymous external client. No public exploit code and no confirmed active exploitation were identified at time of analysis; JPCERT/CC reported the issue and EG Secure Solutions and JVN have published advisories.
OS command injection in EG Secure Solutions' SiteGuard Server Edition allows an attacker who already holds a low-privilege account or foothold on the host to execute arbitrary OS commands as root (Apache httpd/nginx on Linux or FreeBSD) or SYSTEM (IIS on Windows), achieving full compromise of the affected server. The CVSS 4.0 base score of 8.5 reflects a local attack vector (AV:L) with low privileges (PR:L), no user interaction (UI:N), low complexity (AC:L), and high confidentiality, integrity, and availability impact confined to the vulnerable system (VC:H/VI:H/VA:H, SC:N/SI:N/SA:N) - it is not remotely exploitable by an anonymous external client. No public exploit code and no confirmed active exploitation were identified at time of analysis; JPCERT/CC reported the issue and EG Secure Solutions and JVN have published advisories.