Cato Networks Socket Command Injection Vulnerability in Web Interface

A command injection vulnerability has been identified in Cato Networks' Socket versions prior to 25. This vulnerability allows an authenticated attacker with access to the Socket web interface to execute arbitrary operating system commands as the root user on the device's internal system.

Impact

Exploitation of this vulnerability allows for unauthorized execution of operating system commands with root privileges on the affected device.

Remediation

Users are advised to upgrade to Socket version 25 or later to address this vulnerability.