CVE-2021-38611

Name of the Vulnerable Software and Affected Versions NASCENT RemKon Device Manager version 4.0.0.0

Description A command-injection issue in the Image Upload function allows attackers to execute arbitrary commands as root via shell metacharacters in the filename parameter to "assets/index.php".

Recommendations For NASCENT RemKon Device Manager version 4.0.0.0, consider disabling the Image Upload function until a patch is available to prevent exploitation. Restrict access to the "assets/index.php" endpoint to minimize the risk of command injection. Avoid using shell metacharacters in the filename parameter to prevent arbitrary command execution.