CVEvulnerability

CVE-2007-3572

9.3 HIGH Published 2007-07-05 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2007-07-05
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C

Description

Incomplete blacklist vulnerability in cgi-bin/runDiagnostics.cgi in the web interface on the Yoggie Pico and Pico Pro allows remote attackers to execute arbitrary commands via shell metacharacters in the param parameter, as demonstrated by URL encoded "`" (backtick) characters (%60 sequences).

Affected configurations

• yoggie pico • yoggie pico pro

Related

Referenced by CWE · observed example (2)

  • CWE-184 Incomplete List of Disallowed Inputs weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References