CVE-2016-15047

Description

AVTECH devices that include the CloudSetup.cgi management endpoint are vulnerable to authenticated OS command injection. The `exefile` parameter in CloudSetup.cgi is passed to the underlying system command execution without proper validation or whitelisting. An authenticated attacker who can invoke this endpoint can supply crafted input to execute arbitrary system commands as root. Successful exploitation grants full control of the device, and - depending on deployment and whether the device stores credentials or has network reachability to internal systems - may enable credential theft, lateral movement, or data exfiltration. The archived SEARCH-LAB disclosure implies that this vulnerability was remediated in early 2017, but AVTECH has not defined an affected version range.

PUBLISHED Reserved 2025-10-09 | Published 2025-10-09 | Updated 2025-10-09 | Assigner VulnCheck

Problem types

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Product status

Credits

Gergely Eberhardt of SEARCH-LAB.hu finder

References

web.archive.org/...6-AVTech-devices-multiple-vulnerabilities technical-description

web.archive.org/...rch-lab.hu/media/vulnerability_matrix.txt technical-description

www.exploit-db.com/exploits/40500 exploit

www.trendmicro.com/...alware-exploits-cgi-vulnerability.html third-party-advisory

www.sonicwall.com/...ely-targeting-vulnerable-avtech-devices third-party-advisory

www.vulncheck.com/...h-cloudsetup-cgi-auth-command-injection third-party-advisory

cve.org (CVE-2016-15047)

nvd.nist.gov (CVE-2016-15047)

Download JSON