CVE-2016-10043 is a critical OS command injection vulnerability affecting Radisys MRF Web Panel (SWMS) version 9.0.1. An unauthenticated attacker can inject arbitrary operating system commands via the MSM_MACRO_NAME POST parameter in /swms/ms.cgi, leveraging the pipe character to execute commands and retrieve output within application responses. This vulnerability carries a CVSS v3.0 score of 10.0 (Critical) due to its network attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. While there is no indication of active exploitation or inclusion in CISA's KEV catalog, public exploit code is available via ExploitDB (EDB-41179), and it has a high EPSS score, suggesting a significant likelihood of exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
9.0.1CPE matchmatch criteria | cpe:2.3:a:mrf:web_panel:9.0.1:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.