Threats tagged 'ghsa-qf5f-cpcv-rc7c'

An OS command injection vulnerability in a CoreTec product allows authenticated users with certain roles to execute arbitrary system commands. The flaw is in the configuration daemon's time synchronization handler, which unsafely concatenates user input when setting the system time-zone. This can lead to full control over the affected device. The vulnerability has a high severity score of 7.7 and requires authentication with limited privileges. No patch or remediation details are currently provided.