CVE-2018-25159

CRITICAL

9.8

Description

Epross AVCON6 systems management platform contains an object-graph navigation language (OGNL) injection vulnerability that allows unauthenticated attackers to execute arbitrary commands by injecting malicious OGNL expressions. Attackers can send crafted requests to the login.action endpoint with OGNL payloads in the redirect parameter to instantiate ProcessBuilder objects and execute system commands with root privileges.

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published3/11/2026

Last Modified3/12/2026

Sourcenvd

Honeypot Sightings0

Weaknesses (CWE)

CWE-1334

References

https://www.exploit-db.com/exploits/47379(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/epross-avcon6-ognl-remote-code-execution-via-login-action(disclosure@vulncheck.com)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.