TVN ID	TVN-202402002
CVE ID	CVE-2024-26260
CVSS	9.8 (High) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products	OAKlouds-organization-2.0 before version 188、OAKlouds-organization-3.0 before version 188、OAKlouds-webbase-3.0 before version 1051、OAKlouds-webbase-2.0 before 1051
Description	The functionality for synchronization in HGiga OAKlouds' certain moudules has an OS Command Injection vulnerability, allowing remote attackers to inject system commands within specific request parameters. This enables the execution of arbitrary code on the remote server without permission.
Solution	Update OAKlouds-organization-2.0 to 188 or later version Update OAKlouds-organization-3.0 to 188 or later version Update OAKlouds-webbase-2.0 to 1051 or later version Update OAKlouds-webbase-3.0 to 1051 or later version
Credit	Fi Liu (CHT Security)
Public Date	2024-02-15