3onedata Modbus Gateway OS Command Injection Vulnerability in GW1101-1D(RS-485)-TB-P
Vulnerability
A command injection vulnerability has been identified in the 3onedata Modbus gateway model GW1101-1D(RS-485)-TB-P, hardware version V2.2.0. This vulnerability allows authenticated users to execute arbitrary shell commands as the root user. The issue arises from the 'IP address' field in the diagnosis test tools, where payloads can be injected. The vulnerability affects all versions prior to the fixed firmware version 3.0.59B2024080600R4353.
Impact
Exploitation of this vulnerability allows for arbitrary command execution with root privileges on the affected device.
Remediation
Users can upgrade to firmware version 3.0.59B2024080600R4353 to address this vulnerability.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.