Viessmann

In Vitogate 300 2.1.3.0, /cgi-bin/vitogate.cgi allows an unauthenticated attacker to bypass authentication and execute arbitrary commands via shell metacharacters in the ipaddr params JSON data for the put method.

A vulnerability classified as critical was found in Viessmann Vitogate 300 up to 2.1.3.0.

A vulnerability was found in Viessmann Vitogate 300 up to 2.1.3.0 and classified as problematic.

An OS command injection vulnerability has been discovered in the Vitogate 300, which can be exploited by malicious users to compromise affected installations.

The Vitogate 300 web interface fails to enforce proper server-side authentication and relies on frontend-based authentication controls.