CVE-2021-4105CWE-755

Unauthenticated Remote Code Execution on COSLAT Firewall

Critical · published February 24, 2023

CVSS v3.1
9.8
EPSS
1%
Percentile
58.2
In the wild
Unconfirmed
What it is

🚨 A sneaky remote code inclusion vulnerability in the BG-TEK COSLAT Firewall could let attackers run their own code, all because of improper parameter handling! 🔥 Think of it like a hotel manager handing out master keys to anyone without checking IDs. An attacker could waltz in and control the entire system, like being able to explore every room unchecked! This is absolutely devastating! An attacker could hijack the firewall, potentially gaining access to sensitive data, altering configurations, or even launching attacks on other systems. The possibilities are terrifying!

Put simply

Think of it like a hotel manager handing out master keys to anyone without checking IDs. An attacker could waltz in and control the entire system, like being able to explore every room unchecked! This vulnerability arises from improper handling of parameters, enabling remote code inclusion in versions of the COSLAT Firewall from 5.24.0.R.20180630 before 5.24.0.R.20210727. It allows an attacker to execute arbitrary commands on the device remotely.

What to do

This is absolutely devastating! An attacker could hijack the firewall, potentially gaining access to sensitive data, altering configurations, or even launching attacks on other systems. The possibilities are terrifying! Immediate action is crucial! Upgrade your COSLAT Firewall to version 5.24.0.R.20210727 or later to patch this vulnerability. Ensure you also conduct a security review of your firewall settings post-update. You've got this! Follow these steps, and you'll be a security hero in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00865 · 58.2th percentile
Weakness
CWE-755 · Improper Handling of Exceptional Conditions
Published
2023-02-24T11:09Z
EPSS history
Timeline
  • 24 FEB 11:09Z
    Unauthenticated Remote Code Execution on COSLAT Firewall
    cvelistv5