We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
A command injection vulnerability exists in the eScan Web Management Console version 5.5-2. The application fails to properly sanitize the 'pass' parameter when processing login requests to login.php, allowing an authenticated attacker with a valid username to inject arbitrary commands via a specially crafted password value. Successful exploitation results in remote code execution. Privilege escalation to root is possible by abusing the runasroot utility with mwconf-level privileges.
Reserved 2025-07-24 | Published 2025-07-25 | Updated 2025-07-25 | Assigner VulnCheckCWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-306 Missing Authentication for Critical Function
Joxean Koret
www.exploit-db.com/exploits/32869
raw.githubusercontent.com/...ntivirus/escan_password_exec.rb
www.vulncheck.com/...eb-management-console-command-injection
nvd.nist.gov (CVE-2014-125118)
Support options