CVE-2025-2071CWE-78

OS Command Injection Vulnerability in FAST LTA Silent Brick WebUI

Critical · published March 31, 2025

CVSS v4.0
10.0
EPSS
1%
Percentile
61.7
In the wild
Unconfirmed
What it is

A critical OS Command Injection vulnerability has been identified in the FAST LTA Silent Brick WebUI, allowing remote attackers to execute arbitrary operating system commands via specially crafted input. This vulnerability arises due to improper handling of untrusted input, which is passed directly to system-level commands without adequate sanitization or validation. Successful exploitation could allow attackers to execute arbitrary commands on the affected system, potentially resulting in unauthorized access, data leakage, or full system compromise. Affected WebUI parameters are "hd" and "pi".

The record
Technical detail
CVSS v4.0
10.0 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/AU:N/RE:M/U:Amber
EPSS
0.00975 · 61.7th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-03-31T08:33Z
EPSS history
Timeline
  • 31 MAR 08:33Z
    OS Command Injection Vulnerability in FAST LTA Silent Brick WebUI
    cvelistv5