CVE-2018-25159

CRITICAL SEVERITY

CVSS Score & Metrics

Base Score

9.8 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H                                    

Vulnerability Description

Epross AVCON6 systems management platform contains an object-graph navigation language (OGNL) injection vulnerability that allows unauthenticated attackers to execute arbitrary commands by injecting malicious OGNL expressions. Attackers can send crafted requests to the login.action endpoint with OGNL payloads in the redirect parameter to instantiate ProcessBuilder objects and execute system commands with root privileges.

Vulnerability Details

Published Date

March 11, 2026

Last Modified

March 12, 2026

CWE ID

CWE-1334

Source

NVD

Vendor

Epross

Product

AVCON6 systems management platform

External References

https://www.exploit-db.com/exploits/47379
https://www.vulncheck.com/advisories/epross-avcon-ognl-remote-code-execution-via-loginaction

CVE-2018-25159

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment