An OS command injection vulnerability in the discover_and_manage CGI script in NETSAS Enigma NMS 65.0.0 and prior allows an attacker to exec

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• netsas enigma network management solutionup to 65.0.0 inclusive

Other highest-scoring records for the same primary product.

• CVE-2019-16064NETSAS Enigma NMS 65.0.0 and prior suffers from a directory traversal vulnerability that can allow an authenticated user to access files and
  38Monitor
• CVE-2019-16066An unrestricted file upload vulnerability exists in user and system file upload functions in NETSAS Enigma NMS 65.0.0 and prior.
  36Monitor
• CVE-2019-16065A remote SQL injection web vulnerability was discovered in the Enigma NMS 65.0.0 and prior web application that allows an attacker to execut
  36Monitor
• CVE-2019-16068A CSRF vulnerability exists in NETSAS ENIGMA NMS version 65.0.0 and prior that could allow an attacker to be able to trick a victim into sub
  35Monitor
• CVE-2019-16061A number of files on the NETSAS Enigma NMS server 65.0.0 and prior are granted weak world-readable and world-writable permissions, allowing
  35Monitor
• CVE-2019-16063NETSAS Enigma NMS 65.0.0 and prior does not encrypt sensitive data rendered within web pages.
  30Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

User input is inserted as text into a shell command. The shell may interpret special characters in the input as part of the command.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const host = req.body.host;2exec("ping -c 1 " + host, onResult);

1const host = req.body.host;2if (!/^[a-z0-9.-]{1,253}$/i.test(host)) return res.sendStatus(400);3execFile("ping", ["-c", "1", host], onResult);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.