Pusheax

A critical issue has been found, affecting an unknown function of the file /var/www/cmd.php. The manipulation of the `cmd` argument leads to improper authorization, allowing for remote attacks. The issue has been publicly disclosed, and the vendor was contacted but did not respond.

A critical issue has been found, affecting the function `popen` of the file `/var/www/cgi-bin/upgrade.cgi` in the component File Name Handler. The manipulation of the argument `uploadedFile` leads to os command injection. This issue can be exploited remotely. The exploit has been publicly disclosed, and the vendor was contacted but did not respond.

A critical issue affects some unknown functionality of the file /admin/system.html. The manipulation of the argument `uploadedFile` with the input ';whoami' leads to os command injection. This can be exploited remotely.

A critical vulnerability was found in the Web Management Interface component of Viessmann Vitogate 300. This issue affects the `isValidUser` function of the file `/cgi-bin/vitogate.cgi`, leading to the use of a hard-coded password. The exploit has been disclosed publicly and may be used. The vulnerability is being actively exploited.