title: Authenticated Remote Code Execution in Kiloview NDI N series products
description: An OS Command Injection vulnerability in Kiloview NDI allows a low-privileged user to execute arbitrary code remotely on the device with high privileges.
This issue affects Kiloview NDI N3, N3-s, N4, N20, N30, N40 and was fixed in Firmware version 2.02.0227 .
problem types: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
affected:
{
defaultStatus: affected
product: NDI
vendor: Kiloview
versions:
status: unaffected, version: N3 Firmware 2.02.0227
status: unaffected, version: N3-s Firmware 2.02.0227
status: unaffected, version: N4 Firmware 2.02.0227
status: unaffected, version: N20 Firmware 2.02.0227
status: unaffected, version: N30 Firmware 2.02.0227
status: unaffected, version: N40 Firmware 2.02.0227
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Upgrade to the firmware  2.02.0227 or later
workarounds: Restrict access to the
management interface of all affected Kiloview devices by applying strict firewall rules or other available means.