CVE-2018-25159

Epross AVCON6 systems management platform contains an object-graph navigation language (OGNL) injection vulnerability that allows unauthenticated attackers to execute arbitrary commands by injecting malicious OGNL expressions. Attackers can send crafted requests to the login.action endpoint with OGNL payloads in the redirect parameter to instantiate ProcessBuilder objects and execute system commands with root privileges.

Scoring

Severity

CRITICAL

CVSS base score

9.8

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS probability

0.39%

CWE

CWE-1334, CWE-1334

Published

2026-03-11

Last modified

2026-04-07

Affected products

• Epross AVCON6 systems management platform

Weakness type

• CWE-1334
• CWE-1334

Related vulnerabilities

• CVE-2022-41804 — Unauthorized error injection in Intel(R) SGX or Intel(R) TDX for some Intel(R) Xeon(R) Processors...

Markdown version · Browse all CVEs