CVE-2012-10040 is a critical command injection vulnerability in Openfiler v2.x, specifically within the system.html page. An authenticated attacker can exploit unsanitized input in the 'device' parameter to execute arbitrary commands as the 'openfiler' user. Due to misconfigured sudoers, this user can then escalate privileges to root without a password, leading to complete system compromise. This vulnerability carries a CVSS score of 9.4 (Critical), indicating a severe risk with a low attack complexity and requiring only low privileges for an attacker to achieve full confidentiality, integrity, and availability impact. Its high EPSS score and FAUCET Risk Score further emphasize its exploitability and potential for widespread impact. Exploit intelligence confirms the existence of a Metasploit module for this vulnerability, indicating readily available exploit code. While not listed on ExploitDB or KEV, the significant community discussion surrounding this CVE suggests active awareness and potential for exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Openfiler | Openfiler | 2.0CNA affecteddefault unknown |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 1.0 Bluesky, 0.5 Mastodon, and 1.6 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.