CVE-2022-36784

Elsight – Elsight Halo  Remote Code Execution (RCE) Elsight Halo web panel allows us to perform connection validation. through the POST request : /api/v1/nics/wifi/wlan0/ping we can abuse DESTINATION parameter and leverage it to remote code execution.

Score

CVSS 3.1 9.8 Critical

Status

Modified - cna@cyber.gov.il

Published

2022-11-17

Last modified

2025-04-25

Weaknesses

CWE-20

Affected products

• Elsight Halo (Elsight)
• Halo Firmware (Elsight)

References

• https://www.gov.il/en/Departments/faq/cve_advisories