[0day-rubbish] Abyss Web Server X1 2.16.22.0 first-run console credential takeover to configuration-write log-as-CGI command execution (7.5)
Researchers disclosed a command-execution chain in Aprelium Abyss Web Server X1 2.16.22.0 before console password setup.
The 0day Rubbish Research Team publicly disclosed a vulnerability chain in Aprelium’s free Abyss Web Server X1 2.16.22.0, described as the vendor’s current official release. Before an administrator sets a console password, a client admitted by the shipped configuration can take over console credentials, write configuration, and reach command execution by treating logs as CGI. The post rates the issue 7.5. No CVE is named, and exploitation in the wild is not reported.
- Affects Abyss Web Server X1 2.16.22.0, called the current official release.
- Exposed from first start until an administrator sets a console password.
- Chain covers console credential takeover, configuration write, and log-as-CGI command execution.
- Disclosure rates the issue 7.5; no CVE or observed exploitation is stated.
- Vendors
- Aprelium
- Products
- Abyss Web Server X1
- Organizations
- 0day Rubbish Research Team
- Countries
- Tunisia
From the original article
Posted by disclosure via Fulldisclosure on Oct 15 0day Rubbish Research Team is publicly disclosing a vulnerability chain in Abyss Web Server X1 2. 16. 22.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.