Skip to content
CVE Tracker
Back

CVE-2012-10040

Openfiler v2.x NetworkCard Command Execution

Critical9.4EPSS 3.4%
Published
Updated
Reserved
Assigned by
VulnCheck

Description

Openfiler v2.x contains a command injection vulnerability in the system.html page. The device parameter is used to instantiate a NetworkCard object, whose constructor in network.inc calls exec() with unsanitized input. An authenticated attacker can exploit this to execute arbitrary commands as the openfiler user. Due to misconfigured sudoers, the openfiler user can escalate privileges to root via sudo /bin/bash without a password.

Scores

CVSS scores of CVE-2012-10040, by who scored it
Scored byCVSSScoreVector
VulnCheckCNA (assigner)4.0Critical9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
NVDNVD · Deferred4.0Critical9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (exploitation in 30 days)
3.4% · top 11% of all CVEs (2 Nov 2026)
CISA SSVC
Exploitation: poc · Automatable: no · Technical impact: total

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.4.

Weakness

Affected products

  • Openfiler · Openfiler

    • affected 2.0

References (5)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .