CVE-2018-25159
Published: 11 March 2026
Description
Epross AVCON6 systems management platform contains an object-graph navigation language (OGNL) injection vulnerability that allows unauthenticated attackers to execute arbitrary commands by injecting malicious OGNL expressions. Attackers can send crafted requests to the login.action endpoint with OGNL payloads in the…
more
redirect parameter to instantiate ProcessBuilder objects and execute system commands with root privileges.
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents OGNL injection by requiring validation of untrusted inputs like the redirect parameter in login.action to block malicious expressions.
Requires timely remediation of the specific OGNL injection flaw through patching, eliminating the root cause of unauthenticated RCE.
Boundary protection at web interfaces can deploy web application firewalls to inspect and block crafted HTTP requests containing OGNL payloads.
Security SummaryAI
CVE-2018-25159 is an object-graph navigation language (OGNL) injection vulnerability in the Epross AVCON6 systems management platform. It enables unauthenticated attackers to execute arbitrary commands by injecting malicious OGNL expressions into crafted requests targeting the login.action endpoint, specifically via the redirect parameter. This allows instantiation of ProcessBuilder objects to run system commands with root privileges. The issue carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-1334.
Unauthenticated remote attackers can exploit the vulnerability with low complexity and no user interaction required. By sending HTTP requests containing OGNL payloads in the redirect parameter to login.action, they achieve remote code execution, gaining full control over the system including high confidentiality, integrity, and availability impacts through root-level command execution.
Advisories and related resources, including the VulnCheck advisory at https://www.vulncheck.com/advisories/epross-avcon6-ognl-remote-code-execution-via-login-action and a proof-of-concept exploit at https://www.exploit-db.com/exploits/47379, provide further technical details on the vulnerability. No specific patches or mitigations are detailed in the provided information.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an unauthenticated OGNL injection in a public-facing web login endpoint (login.action), enabling remote code execution via crafted HTTP requests, directly mapping to exploitation of public-facing applications.