Command injection in NAT32 - CVE-2018-6940

Vulnerability identifier: #VU10653

CSH Severity: High

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber

CVE-ID: CVE-2018-6940

CWE-ID: CWE-77

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vendor: NAT Software

Affected software:
NAT32

The vulnerability allows a remote attacker to execute arbitrary command on the target system. 

 The weakness exists due to an error within the Password Checking feature. An attacker can disable Password Checking, inject and execute arbitrary commands.

Cybersecurity is currently unaware of any solutions addressing the vulnerability.

• https://www.exploit-db.com/exploits/44033/