| Package | Affected versions | Patched versions |
|---|---|---|
| network monitor | ≥ 15.37, ≤ 16.5 |
The application login page in AKIPS Network Monitor 15.37 through 16.5 allows a remote unauthenticated attacker to execute arbitrary OS commands via shell metacharacters in the username parameter (a failed login attempt returns the command-injection output to a limited login failure field). This is fixed in 16.6.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free