Skip to content
OpenAdvisories
Critical ICSA-21-147-03 5 CVEs

MesaLabs AmegaView

Published May 27, 2021 · Updated May 27, 2021

Vendor: Mesa Labs Product: AmegaView

Summary

Successful exploitation of these vulnerabilities could allow remote code execution or allow access to the device.

Vulnerabilities 5

  • Critical 10.0
    CVE-2021-27447

    Mesa Labs AmegaView command injection

    Mesa Labs AmegaView version 3.0 is vulnerable to a command injection, which may allow an attacker to remotely execute arbitrary code.

    Mesa Labs AmegaView
  • Critical 9.9
    CVE-2021-27449

    Mesa Labs AmegaView Command Injection

    Mesa Labs AmegaView Versions 3.0 and prior has a command injection vulnerability that can be exploited to execute commands in the web server.

    Mesa Labs AmegaView
  • High 7.8
    CVE-2021-27445

    Mesa Labs AmegaView Improper Privilege Management

    Mesa Labs AmegaView Versions 3.0 and prior has insecure file permissions that could be exploited to escalate privileges on the device.

    Mesa Labs AmegaView
  • High 7.3
    CVE-2021-27451

    Mesa Labs AmegaView improper authentication

    Mesa Labs AmegaView Versions 3.0 and prior’s passcode is generated by an easily reversible algorithm, which may allow an attacker to gain access to the device.

    Mesa Labs AmegaView
  • High 7.3
    CVE-2021-27453

    Mesa Labs AmegaView authentication bypass

    Mesa Labs AmegaView Versions 3.0 uses default cookies that could be set to bypass authentication to the web application, which may allow an attacker to gain access.

    Mesa Labs AmegaView

Revision history

  1. #1

    ICSA-21-147-03 MesaLabs AmegaView

References