critical9.8Public exploit code
CVE-2018-15137
CeLa Link CLR-M20 devices allow unauthorized users to upload any file (e.g., asp, aspx, cfm, html, jhtml, jsp, or shtml), which causes remote code execution as…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Cela Link CLR-M20 2.7.1.6 - Arbitrary File Upload2018-07-13 · webapps · hardware
Impact
CeLa Link CLR-M20 devices allow unauthorized users to upload any file (e.g., asp, aspx, cfm, html, jhtml, jsp, or shtml), which causes remote code execution as well. Because of the WebDAV feature, it is possible to upload arbitrary files by utilizing the PUT method.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cela Link | Clr-M20 Firmware | Version 2.7.1.6 |