An unauthenticated user with access to the web interface can execute arbitrary system commands within the underlying operating system, which may allow the attacker to copy files, read configuration, write files, delete files, or reboot the device.
An unauthenticated attacker can access core dumps of previously crashed processes through the web interface of the device, which may allow disclosure of sensitive information.
An unauthenticated user may retrieve recently cached configuration commands by sending a crafted URL to the web interface of an affected device, which may allow disclosure of sensitive information.
An authenticated administrative user can execute arbitrary commands on the underlying operating system.
If an attacker can trick an administrator into clicking a link, they could then take administrative actions on the device or expose a session cookie for an administrative session.
Vendor recommends users upgrade to Version 220.127.116.11 or later, which can be downloaded from the following link: