title: White Rabbit Switch - Unauthenticated remote code execution
description: White Rabbit Switch contains a vulnerability which makes it possible for an attacker to perform system commands under the context of the web application (the default installation makes the webserver run as the root user).
problem types: CWE-20 Improper Input Validation
affected:
{
vendor: CERN
product: White Rabbit Switch
versions:
status: affected, version: < v6.0.1, lessThanOrEqual: v6.0.1, versionType: v.x.y.z
defaultStatus: unaffected
}
metrics:
format: CVSS
scenarios: GENERAL
cvssV3_1: [
version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
]
workarounds: Upgrade to version 6.0.2