title: Atop Technology 3G/4G LTE Cellular to Ethernet and Serial Secure Industrial Gateway - Command Injection
description: Atop Technology industrial 3G/4G gateway contains Command Injection vulnerability. Due to insufficient input validation, the device's web management interface allows attackers to inject specific code and execute system commands without privilege.
problem types: CWE-78 OS Command Injection
affected:
{
product: 3G/4G LTE Cellular to Ethernet and Serial Secure Industrial Gateway SE5901
vendor: Atop Technology
versions:
lessThanOrEqual: 1.4, status: affected, version: 1.18, versionType: custom
}
{
product: 3G/4G LTE Cellular to Ethernet and Serial Secure Industrial Gateway SE5901B
vendor: Atop Technology
versions:
lessThanOrEqual: 1.4, status: affected, version: 1.18, versionType: custom
}
{
product: 3G/4G LTE Cellular to Ethernet and Serial Secure Industrial Gateway SE5904D
vendor: Atop Technology
versions:
lessThanOrEqual: 1.4, status: affected, version: 1.18, versionType: custom
}
{
product: 3G/4G LTE Cellular to Ethernet and Serial Secure Industrial Gateway SE5908
vendor: Atop Technology
versions:
status: affected, version: 1.18 1.4
}
{
product: 3G/4G LTE Cellular to Ethernet and Serial Secure Industrial Gateway SE5908A
vendor: Atop Technology
versions:
status: affected, version: 1.18 1.4
}
{
product: 3G/4G LTE Cellular to Ethernet and Serial Secure Industrial Gateway SE5916
vendor: Atop Technology
versions:
status: affected, version: 1.18 1.4
}
{
product: 3G/4G LTE Cellular to Ethernet and Serial Secure Industrial Gateway SE5916A
vendor: Atop Technology
versions:
status: affected, version: 1.18 1.4
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
version: 3.1
]
solutions: Update Firmware series to V1.51