CyberRota Analysis
AI-GeneratedThe vulnerability allows authenticated users with monitor permissions to exploit the ping_check function in Spug versions up to 3.4.0, enabling them to inject shell metacharacters through the /monitor/run_test/ endpoint. This results in remote code execution, allowing attackers to execute arbitrary commands as the Spug process user. Organizations using affected versions should prioritize patching this vulnerability to mitigate the risk of unauthorized command execution.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Spug through 3.4.0 contains a remote code execution vulnerability in the ping_check function that interpolates user-supplied monitor addresses directly into shell commands without validation. Authenticated users with monitor permissions can inject shell metacharacters via the /monitor/run_test/ endpoint to execute arbitrary commands as the Spug process user.