title: Cellopoint CelloOS - Remote Command Execution (RCE)
description: Cellopoint Cellos v4.1.10 Build 20190922 does not validate URL inputted properly. With the cookie of the system administrator, attackers can inject and remotely execute arbitrary command to manipulate the system.
problem types: Remote Command Execution (RCE)
affected:
{
product: CelloOS
vendor: Cellopoint
versions:
lessThanOrEqual: v4.1.10 Build 20190922, status: affected, version: 0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
solutions: Update to v4.1.10 Build 20200210 or higher.