CVE-2018-25159 - CVE House
Back to Database
Status published Critical CVE-2018-25159

Epross AVCON6 OGNL Remote Code Execution via login.action

Vulnerability Description

Epross AVCON6 systems management platform contains an object-graph navigation language (OGNL) injection vulnerability that allows unauthenticated attackers to execute arbitrary commands by injecting malicious OGNL expressions. Attackers can send crafted requests to the login.action endpoint with OGNL payloads in the redirect parameter to instantiate ProcessBuilder objects and execute system commands with root privileges.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-25159

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Nassim Asrir

References

Affected Vendor

Affected Software

AVCON6 systems management platform
Vulnerable Versions:
*

Timeline

Official Publish: March 11th, 2026
Last Modified: April 7th, 2026
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-1334

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.