Vulnerabilities

The affected product is vulnerable to an attacker being able to use commands without providing a password which may allow an attacker to leak information.

The affected product is vulnerable to unrestricted file uploads, which may allow an attacker to remotely execute code.

The affected product is vulnerable to a cross-site scripting attack which may allow an attacker to bypass authentication and takeover admin accounts.

The affected product is vulnerable due to insufficiently protected credentials, which may allow an attacker to impersonate Elvaco and send false information.