Web Robot
Monthly
OS command injection in webgjc web_robot versions 2.4.0, 2.5.0, and 2.8.0 enables remote attackers to execute arbitrary operating system commands by supplying malicious input through the case_name parameter handled by the controller_listen or controller_recover functions in py/web.py. A publicly disclosed proof-of-concept exploit exists, the vendor failed to respond to responsible disclosure, and no patch has been released. The reported CVSS 4.0 base score of 5.3 reflects conservative impact ratings that appear inconsistent with the true scope of OS command injection on an unpatched host.
OS command injection in webgjc web_robot versions 2.4.0, 2.5.0, and 2.8.0 enables remote attackers to execute arbitrary operating system commands by supplying malicious input through the case_name parameter handled by the controller_listen or controller_recover functions in py/web.py. A publicly disclosed proof-of-concept exploit exists, the vendor failed to respond to responsible disclosure, and no patch has been released. The reported CVSS 4.0 base score of 5.3 reflects conservative impact ratings that appear inconsistent with the true scope of OS command injection on an unpatched host.