Skip to content
CVE Tracker
Back

CVE-2012-10039

ZEN Load Balancer Filelog Command Execution

Critical9.4EPSS 3.4%
Published
Updated
Reserved
Assigned by
VulnCheck

Description

ZEN Load Balancer versions 2.0 and 3.0-rc1 contain a command injection vulnerability in content2-2.cgi. The filelog parameter is passed directly into a backtick-delimited exec() call without sanitation. An authenticated attacker can inject arbitrary shell commands, resulting in remote code execution as the root user. ZEN Load Balancer is the predecessor of ZEVENET and SKUDONET. The affected versions (2.0 and 3.0-rc1) are no longer supported. SKUDONET CE is the current community-maintained successor.

Scores

CVSS scores of CVE-2012-10039, by who scored it
Scored byCVSSScoreVector
VulnCheckCNA (assigner)4.0Critical9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
NVDNVD · Deferred4.0Critical9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (exploitation in 30 days)
3.4% · top 11% of all CVEs (3 Nov 2026)
CISA SSVC
Exploitation: poc · Automatable: no · Technical impact: total

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.4.

Weakness

Affected products

  • ZEN Load Balancer · ZEN Load Balancer

    • affected 2.0
    • affected 3.0-rc1

References (5)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .