CyberRota Analysis
AI-GeneratedElecterm versions prior to 3.15.186 are vulnerable to a high-severity issue that allows authenticated WebSocket clients to exploit internal functions, potentially leading to command execution, file manipulation, and process termination. This vulnerability poses significant risks to system integrity and confidentiality, making it critical for users of Electerm, particularly those in environments handling sensitive data, to prioritize upgrading to the patched version. Organizations relying on Electerm for terminal and remote access should take immediate action to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.186, electerm allows an authenticated WebSocket client to invoke unintended internal functions through client-controlled func values in upgrade-func in src/app/server/dispatch-center.js and handleFs in src/app/server/fs.js, exposing Upgrade and fsExport methods that can execute commands, open files, mutate the filesystem, or terminate the process. This issue is fixed in version 3.15.186.