title: Genian NAC remote code execution vulnerability
description: An remote code execution vulnerability due to SSTI vulnerability and insufficient file name parameter validation was discovered in Genian NAC. Remote attackers are able to execute arbitrary malicious code with SYSTEM privileges on all connected nodes in NAC through this vulnerability.
problem types: CWE-20 Improper Input Validation
affected:
{
platforms: Windows
product: Genian NAC Suite V4.0
vendor: Genians Co., Ltd
versions:
lessThanOrEqual: 4.0.145.0831, status: affected, version: unspecified, versionType: custom
}
{
platforms: Windows
product: Genian NAC V5.0 & Genian NAC Suite V5.0
vendor: Genians Co., Ltd
versions:
lessThanOrEqual: 5.0.42.0827, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 9.6
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
]