Tr7 Asp
Monthly
Unauthenticated OS command injection in TR7 Cyber Defense Inc.'s TR7 ASP appliance (both virtual and physical deployments) allows any attacker who can reach the appliance's exposed service to execute operating-system commands without supplying credentials or user interaction. The flaw is rooted in a missing authentication check for a critical function (CWE-306) and carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning full loss of confidentiality, integrity, and availability of the appliance if exploited. All TR7 ASP installations running 1.0.40.236 up to (but not including) 1.0.1554.2331, or 1.6.42.239 up to (but not including) 1.6.1554.2331, are affected; exposure is the primary gating factor, since appliances segmented onto trusted management VLANs are far harder to reach. No public exploit code and no CISA KEV entry have been identified at time of analysis, and no EPSS score was provided with the source data.
Remote unauthenticated OS command injection in TR7 ASP allows an attacker who can reach the appliance over the network to execute arbitrary operating system commands with the privileges of the vulnerable service, yielding full loss of confidentiality, integrity, and availability. Affected builds are TR7 ASP from 1.0.40.236 before 1.0.1554.2331 and from 1.6.42.239 before 1.6.1554.2331, covering both virtual-appliance and physical-appliance deployments. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) per the assessed vector, meaning no authentication, no user interaction, and low attack complexity; no public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV). The primary limiting factors are version and network exposure: only the specified build ranges are affected and the appliance must be reachable by the attacker.
Unauthenticated OS command injection in TR7 Cyber Defense Inc.'s TR7 ASP appliance (both virtual and physical deployments) allows any attacker who can reach the appliance's exposed service to execute operating-system commands without supplying credentials or user interaction. The flaw is rooted in a missing authentication check for a critical function (CWE-306) and carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning full loss of confidentiality, integrity, and availability of the appliance if exploited. All TR7 ASP installations running 1.0.40.236 up to (but not including) 1.0.1554.2331, or 1.6.42.239 up to (but not including) 1.6.1554.2331, are affected; exposure is the primary gating factor, since appliances segmented onto trusted management VLANs are far harder to reach. No public exploit code and no CISA KEV entry have been identified at time of analysis, and no EPSS score was provided with the source data.
Remote unauthenticated OS command injection in TR7 ASP allows an attacker who can reach the appliance over the network to execute arbitrary operating system commands with the privileges of the vulnerable service, yielding full loss of confidentiality, integrity, and availability. Affected builds are TR7 ASP from 1.0.40.236 before 1.0.1554.2331 and from 1.6.42.239 before 1.6.1554.2331, covering both virtual-appliance and physical-appliance deployments. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) per the assessed vector, meaning no authentication, no user interaction, and low attack complexity; no public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV). The primary limiting factors are version and network exposure: only the specified build ranges are affected and the appliance must be reachable by the attacker.