Skip to content
OpenAdvisories
Critical ICSA-19-078-02 6 CVEs

Columbia Weather Systems MicroServer

Published Mar 19, 2019 · Updated Mar 19, 2019

Vendor: Columbia Weather Systems Product: Weather MicroServer

Summary

Successful exploitation of these vulnerabilities may allow disclosure of data, cause a denial-of-service condition, and allow remote code execution.

Vulnerabilities 6

  • Unscored —
    CVE-2018-18875

    In firmware version MS_2.6.9900 of Columbia Weather MicroServer, a stored Cross-site scripting (XSS) vulnerability allo…

  • Unscored —
    CVE-2018-18876

    In firmware version MS_2.6.9900 of Columbia Weather MicroServer, a readouts_rd.php directory traversal issue makes it p…

  • Unscored —
    CVE-2018-18877

    In firmware version MS_2.6.9900 of Columbia Weather MicroServer, an authenticated web user can access an alternative co…

  • Unscored —
    CVE-2018-18878

    In firmware version MS_2.6.9900 of Columbia Weather MicroServer, the BACnet daemon does not properly validate input, wh…

  • Unscored —
    CVE-2018-18879

    In firmware version MS_2.6.9900 of Columbia Weather MicroServer, an authenticated web user can pipe commands directly t…

  • Unscored —
    CVE-2018-18880

    In firmware version MS_2.6.9900 of Columbia Weather MicroServer, a networkdiags.php reflected Cross-site scripting (XSS…

Revision history

  1. #1

    ICSA-19-078-02 Columbia Weather Systems MicroServer

References