Dany Bach

An unauthenticated remote attacker with network access to the affected service can execute arbitrary code within the context of the IIS application service account.

The issue allows local users to conduct a jailbreak attack and obtain root privileges by overwriting the /etc/shadow file, due to /usr/bin/lua being installed setuid to the itadmin account. This enables a BusyBox jailbreak attack.

The issue is related to an unauthenticated SQL injection in the eonweb component, specifically affecting the logout.php file. This vulnerability is due to a lack of protection in the SQL query structure, allowing a remote attacker to bypass access control rules and gain remote root access to the server. The exploitation of this issue can occur after authentication using the session table, taking advantage of insufficient permissions in SNMPd.