description: serial-number through 1.3.0 allows execution of arbritary commands. The "cmdPrefix" argument in serialNumber function is used by the "exec" function without any validation.
problem types: Command Injection
affected:
{
product: serial-number
vendor: n/a
versions:
status: affected, version: All versions including 1.3.0
}