Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2018-20727: NeDi before 1.7Cp3 lets logged‑in users run code
CVE-2018-20727 · published 7 years ago
Summary
The NeDi network‑monitoring tool versions earlier than 1.7Cp3 let a user who has logged in craft special web requests that cause the server to execute arbitrary commands. This could let an attacker take control of the server or access data they shouldn’t see. Upgrade NeDi to version 1.7Cp3 or later, or apply the vendor’s recommended patches, and restrict access to trusted users only.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| nedi | nedi |
<= 1.7c cpe:2.3:a:nedi:nedi:*:*:*:*:*:*:*:* |
Original advisory text
Multiple command injection vulnerabilities in NeDi before 1.7Cp3 allow authenticated users to execute code on the server side via the flt parameter to Nodes-Traffic.php, the dv parameter to Devices...
Multiple command injection vulnerabilities in NeDi before 1.7Cp3 allow authenticated users to execute code on the server side via the flt parameter to Nodes-Traffic.php, the dv parameter to Devices-Graph.php, or the tit parameter to drawmap.php.
References
- https://www.nedi.ch/end-of-year-update/ Vendor Advisory
- https://www.sakerhetskontoret.com/disclosures/nedi/report.html Exploit Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-78OS Command Injection
Timeline
Published17 Jan 2019
Updated22 Oct 2026
First seen29 Sep 2026
Sources
CVE-2018-20727 · NVD
Track software like this
Free during beta