Vulnerability identifier: #VU19316

Vulnerability risk: Critical

CVSSv3.1: 9.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C]

CVE-ID: CVE-2019-12725

CWE-ID: CWE-78

Exploitation vector: Network

Exploits in database: 3

• September 22, 2021
  • PocList (漏洞POC、EXP合集，持续更新。Apache Druid-任意文件读取（CVE-2021-36749）、ConfluenceRCE（CVE-2021-26084）、ZeroShell防火墙RCE（CVE-2019-12725）、ApacheSolr任意文件读取、蓝凌OA任意文件读取、phpStudyRCE、ShowDoc任意文件上传、原创先锋后台未授权、Kyan账号密码泄露、TerraMasterTos任意文件读取、TamronOS-IPTV系统RCE、Wayos防火墙账号密码泄露) [Github]
• June 17, 2021
  • ZeroShell 3.9.0 - 'cgi-bin/kerbynet' Remote Root Command Injection (Metasploit) [Exploit-DB]
• May 20, 2021
  • ZeroShell 3.9.0 - Remote Command Execution [Exploit-DB]

Impact: Code execution

Vulnerable software:
Zeroshell
Web applications / Other software

Vendor: ZeroShell