title: Mesa Labs AmegaView Command Injection
description: Mesa Labs AmegaView Versions 3.0 and prior has a command injection vulnerability that can be exploited to execute commands in the web server.
problem types: CWE-77: Command Injection
affected:
{
product: AmegaView
vendor: Mesa Labs
versions:
lessThanOrEqual: 3.0, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
]
workarounds: MesaLabs has scheduled AmegaView for end-of-life at the end of 2021. Due to this discontinued service, MesaLabs does not plan to release an update to address these vulnerabilities. MesaLabs recommends users upgrade to the newer ViewPoint software that is compatible with AmegaView hardware.