Critical severity9.8NVD Advisory· Published Jul 25, 2017· Updated May 13, 2026
CVE-2015-2279
CVE-2015-2279
Description
cgi_test.cgi in AirLive BU-2015 with firmware 1.03.18, BU-3026 with firmware 1.43, and MD-3025 with firmware 1.81 allows remote attackers to execute arbitrary OS commands via shell metacharacters after an "&" (ampersand) in the write_mac write_pid, write_msn, write_tan, or write_hdv parameter.
Affected products
3- cpe:2.3:o:airlive:bu-2015_firmware:1.03.18:*:*:*:*:*:*:*
- cpe:2.3:o:airlive:bu-3026_firmware:1.43:*:*:*:*:*:*:*
- cpe:2.3:o:airlive:md-3025_firmware:1.81:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
6- packetstormsecurity.com/files/132585/AirLive-Remote-Command-Injection.htmlnvdExploitThird Party AdvisoryVDB Entry
- seclists.org/fulldisclosure/2015/Jul/29nvdExploitMailing ListThird Party AdvisoryVDB Entry
- www.coresecurity.com/advisories/airlive-multiple-products-os-command-injectionnvdExploitTechnical DescriptionThird Party Advisory
- www.exploit-db.com/exploits/37532/nvdExploitThird Party AdvisoryVDB Entry
- www.securityfocus.com/bid/75559nvdThird Party AdvisoryVDB Entry
- www.securityfocus.com/archive/1/535938/100/0/threadednvd
News mentions
0No linked articles in our index yet.