CVE-2010-2892

CVE-2010-2892 is a critical OS command injection vulnerability affecting LANDesk Management Gateway versions 4.0 through 4.0-1.48 and 4.2 through 4.2-1.8. This flaw allows remote authenticated administrators to execute arbitrary commands by injecting shell metacharacters into the DRIVES parameter, often via a Cross-Site Request Forgery (CSRF) attack. With a CVSS score of 8.5, it presents a high risk due to its network-based attack vector, medium attack complexity, and complete compromise of confidentiality, integrity, and availability. While not listed in CISA's KEV catalog, an exploit is publicly available on ExploitDB, though there is no evidence of active exploitation, Metasploit modules, or significant community discussion.