Description
CGServiSign developed by Changing has a OS Command Injection vulnerability. Unauthenticated remote attackers can induce victims to visit a malicious web page and inject arbitrary OS commands through the local service interface, resulting in command execution on the victim's local computer.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Changing | CGServiSign | 1.0.23.1227 | — |
References
- https://www.twcert.org.tw/tw/cp-132-11213-28a81-1.html third-party-advisory
- https://www.twcert.org.tw/en/cp-139-11214-89281-2.html third-party-advisory