CVE-2018-25159

CRITICAL

9.8

Description

Epross AVCON6 systems management platform contains an object-graph navigation language (OGNL) injection vulnerability that allows unauthenticated attackers to execute arbitrary commands by injecting malicious OGNL expressions. Attackers can send crafted requests to the login.action endpoint with OGNL payloads in the redirect parameter to instantiate ProcessBuilder objects and execute system commands with root privileges.

Details CVE

Score CVSS v3.19.8

SeveriteCRITICAL

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie3/11/2026

Derniere modification3/12/2026

Sourcenvd

Observations honeypot0

Faiblesses (CWE)

CWE-1334

References

https://www.exploit-db.com/exploits/47379(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/epross-avcon6-ognl-remote-code-execution-via-login-action(disclosure@vulncheck.com)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.