Oinone Pamirs vulnerabilities

Oinone Pamirs version 7.0.0 contains a command injection vulnerability in the CommandHelper.executeCommands method. This method starts a shell process and writes attacker-controlled command strings directly to the process standard input without sanitization.

A security flaw was discovered in Oinone Pamirs up to 7.2.0 in the request.getParameter function of LocalFileClient.java (RestController component). Manipulation of the uniqueFileName argument results in path traversal. The attack may be carried out on the physical device and the exploit is publicly available.

Oinone Pamirs up to 7.2.0 contains a vulnerability in the JsonUtils.parseMap function of PamirsParserConfig.java in the appConfigQuery Interface component. Manipulation leads to deserialization, and the attack can be launched remotely. The exploit is publicly available and the vendor did not respond.