Riverbed SteelCentral NetProfiler/NetExpress Remote Code Execution
Posted by deepcore on July 13, 2016 – 3:13 am
This Metasploit module exploits three separate vulnerabilities found in the Riverbed SteelCentral NetProfiler/NetExpress virtual appliances to obtain remote command execution as the root user. A SQL injection in the login form can be exploited to add a malicious user into the application’s database. An attacker can then exploit a command injection vulnerability in the web interface to obtain arbitrary code execution. Finally, an insecure configuration of the sudoers file can be abused to escalate privileges to root.
Post a reply
You must be logged in to post a comment.