CVE-2018-18879

8.8 highEPSS 2.0%

In firmware version MS_2.6.9900 of Columbia Weather MicroServer, an authenticated web user can pipe commands directly to the underlying operating system as user input is not sanitized in networkdiags.php.

Severity

CVSS 3.0

8.8 high

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.0% chance of exploitation in the next 30 days; higher than 80% of CVEs (scores of 2026-10-31)
CWE: CWE-94
Published: 2019-06-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

columbiaweather:weather_microserver_firmware

References

https://applied-risk.com/labs/advisories
https://ics-cert.us-cert.gov/advisories/ICSA-19-078-02
https://applied-risk.com/labs/advisories
https://ics-cert.us-cert.gov/advisories/ICSA-19-078-02

Check your stack JSON