Vestel EVC04 SQL Injection Vulnerability in Configuration Interface

A SQL injection vulnerability has been identified in the Vestel EVC04 Configuration Interface, allowing for improper neutralization of special elements used in SQL commands. This issue affects versions of the EVC04 Configuration Interface through March 18, 2025.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate SQL queries to the application's database. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Remediation

The vulnerability has not yet been addressed by the manufacturer. The National Cyber Incident Response Center (USOM) recommends users and system administrators consider using alternative software.