CVE-2019-12771

Name of the Vulnerable Software and Affected Versions ThinStation versions prior to 6.1.2

Description Command injection is possible through shell metacharacters after the "cgi-bin/CdControl.cgi" action= substring, or after the "cgi-bin/VolControl.cgi" OK= substring.

Recommendations For versions prior to 6.1.2, update to version 6.1.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the cgi-bin/CdControl.cgi and cgi-bin/VolControl.cgi endpoints until a patch is available. Avoid using shell metacharacters in the action= and OK= substrings to minimize the risk of exploitation.