title: Commend WS203VICM Argument Injection
description: A remote, unauthenticated attacker may be able to send crafted messages
to the web server of the Commend WS203VICM causing the system to
restart, interrupting service.
problem types: CWE-88 Argument Injection
affected:
{
defaultStatus: unaffected
product: WS203VICM
vendor: Commend
versions:
lessThanOrEqual: 1.7, status: affected, version: 0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Although this is an end-of-life product, Commend has created new firmware  version WS-CM 2.0 https://clibrary-online.commend.com/   to
address the first two issues. The new firmware can be loaded via the
program "IP Station Config". To install the firmware, follow the
instructions below:
*  Log in to the Commend web-portal.
*  Download and extract the "Terminals Software Package".
*  In "IP Station Config", select the stations to be updated in the table.
*  Go to: Menu Station > Firmware Download
*  Select the file "WS-CM 2.0.geh" from the folder "WS-CM" and click on the button Open.
For additional information, please visit  CSA-2024-42 on Commend's cybersecurity website. https://clibrary-online.commend.com/en/cyber-security/security-advisories.html