Skip to content
Fencer Intel
critical 9.3

CVE-2012-10041 json

WAN Emulator v2.3 Command Execution

published 2025-08-08 15 mo ago modified 2026-06-16 4 mo ago also EUVD-2012-6592

cvss
9.3
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
4.0%
EPSS 4.0% chance of exploitation in 30 days, percentile 90%
public exploits
1
Metasploit

Summary

WAN Emulator v2.3 contains two unauthenticated command execution vulnerabilities. The result.php script calls shell_exec() with unsanitized input from the pc POST parameter, allowing remote attackers to execute arbitrary commands as the www-data user. The system also includes a SUID-root binary named dosu, which is vulnerable to command injection via its first argument. An attacker can exploit both flaws in sequence to achieve full remote code execution and escalate privileges to root.

Timeline

  1. First public exploit (Metasploit exploit/linux/http/wanem_exec)
  2. Published

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
total
Assessed
15 mo ago

Exploit prediction

4.02% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • Metasploit exploit/linux/http/wanem_exec WAN Emulator v2.3 Command Execution metasploit exploit, excellent rank, 2012-08-12
  • raw.githubusercontent.com https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/wanem_exec.rb referenced PoC, tagged "exploit" by a source, unverified
  • exploit-db.com https://www.exploit-db.com/exploits/21190 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA 4.0 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • WAN Emulator WAN Emulator

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.