Records3All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
Altus records in CISA KEVNo Altus vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsPriority MEDIUM 44
Authenticated Semi-Blind Command Injection (via Parameter Injection) exists on Altus Nexto, Nexto Xpress, and Hadron Xtorm devices via the getlogs.cgi tcpdump feature.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.03484 · Published 2021-08-23 · No fix listed CWE-78
Priority LOW 36
Hardcoded .htaccess Credentials for getlogs.cgi exist on Altus Nexto, Nexto Xpress, and Hadron Xtorm devices.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01346 · Published 2021-08-23 · No fix listed CWE-798
Priority LOW 30
Cross-Site Request Forgery (CSRF) exists on Altus Nexto, Nexto Xpress, and Hadron Xtorm devices via any CGI endpoint.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00535 · Published 2021-08-23 · No fix listed CWE-352
