CVEvulnerability
CVE-2013-6881
10.0 HIGH
Official page ↗
- Status
- Modified
- Published
- 2014-01-07
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-78
Description
CRU Ditto Forensic FieldStation with firmware before 2013Oct15a allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) sector size or (2) skip count fields for the forensic imaging task.
Affected configurations
• cru-inc ditto forensic fieldstation firmware (<= 2013jun30a)
• cru-inc ditto forensic fieldstation
Related
Weakness · CWE (1)
- CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness
References
- http://packetstormsecurity.com/files/124420/Ditto-Forensic-FieldStation-2013Oct15a-XSS-CSRF-Command-Execution.html Exploit
- http://seclists.org/fulldisclosure/2013/Dec/80 Exploit
- http://secunia.com/advisories/55989 Vendor Advisory
- http://www.cru-inc.com/support/software-downloads/ditto-firmware-updates/ditto-firmware-release-notes-2013jun30a/ Vendor Advisory
- http://www.cru-inc.com/support/software-downloads/ditto-firmware-updates/ditto-firmware-release-notes-2013oct15a/ Vendor Advisory
- http://www.exploit-db.com/exploits/30396 Exploit
- http://packetstormsecurity.com/files/124420/Ditto-Forensic-FieldStation-2013Oct15a-XSS-CSRF-Command-Execution.html Exploit
- http://seclists.org/fulldisclosure/2013/Dec/80 Exploit
- http://secunia.com/advisories/55989 Vendor Advisory
- http://www.cru-inc.com/support/software-downloads/ditto-firmware-updates/ditto-firmware-release-notes-2013jun30a/ Vendor Advisory
- http://www.cru-inc.com/support/software-downloads/ditto-firmware-updates/ditto-firmware-release-notes-2013oct15a/ Vendor Advisory
- http://www.exploit-db.com/exploits/30396 Exploit