title: HGiga OAKlouds - Command Injection-1
description: The HGiga OAKlouds mobile portal does not filter special characters of the Ethernet number parameter of the network interface card setting page. Remote attackers can use this vulnerability to perform command injection and execute arbitrary commands in the system without logging in.
problem types: CWE-78 OS Command Injection
affected:
{
product: OAKlouds OAKSv2
vendor: HGiga
versions:
lessThanOrEqual: OAKlouds-network-2.0-2, status: affected, version: OAKlouds-network 2.0, versionType: custom
}
{
product: OAKlouds OAKSv3
vendor: HGiga
versions:
lessThanOrEqual: OAKlouds-network-3.0-2, status: affected, version: OAKlouds-network 3.0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
solutions: Update OAKlouds OAKSv2 to version OAKlouds-network-2.0-3
Update OAKlouds OAKSv3 to version OAKlouds-network-2.0-3