Database/Firmware, BMC & network fabric
Lantronix PremierWave 2050 console server (Web Manager): Same class of bug as the Traceroute injection on this device
Impact
Same class of bug as the Traceroute injection on this device, reached through the Ping diagnostic instead — full command execution on the console server, with downstream reach into every serial line it terminates.
Who can reach it
Any authenticated Web Manager user submits a crafted host value to the Diagnostics: Ping function; the value flows unsanitized into a shell command.
What to do
Firmware upgrade past 8.9.0.0R4 and reboot. Same rollout cost as the Traceroute bug — treat both as one patch cycle per unit rather than two separate maintenance windows.
References
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.