Executive brief
VA MAX, a load balancing administration system, contains a security flaw that allows an authorized user to take full control of the server. By submitting specially crafted network configuration data, an attacker can execute unauthorized commands with administrative privileges. This could lead to a complete system takeover, theft of sensitive data, or disruption of network services.
Technical details
A remote code execution vulnerability exists in VA MAX 8.3.4 due to improper input validation in the changeip.php component. An authenticated attacker can exploit this by sending a POST request to the /lbadmin/config/changeip.php endpoint containing shell metacharacters within the 'mtu_eth0' parameter. This results in command injection, allowing the attacker to execute arbitrary shell commands as the 'apache' user. Publicly available exploit code demonstrates that the 'apache' user may have NOPASSWD sudo privileges, potentially leading to a full root compromise of the underlying system.
Affected products
- VA MAX VA MAX 8.3.4
Timeline
- 2019-02-11: disclosed: Initial exploit published on Exploit-DB
- 2026-04-05: advisory: CVE published/updated via VulnCheck and NVD