CVE-2021-46704

—

CVSS 3.1

9.8 critical

EPSS

22%p97

Published

Mar 6, 2022 (Mar 6, 2022)

Modified

Jun 17, 2026

Description

In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument (lib/ui/api.ts and lib/ping.ts). The vulnerability arises from insufficient input validation combined with a missing authorization check.

Vendors: genieacs
Products: genieacs
Weakness: CWE-78
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (21.9%)

In the news0 stories

No ingested article mentions this CVE yet.