CVE-2018-25159 Epross AVCON6 OGNL Remote Code Execution via login.action
Unauthenticated attackers can execute arbitrary system commands with root privileges via OGNL injection in the login.action endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-25159?
CVE-2018-25159 is a critical code injection vulnerability in Epross AVCON6 systems management platform, published on 11 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Epross AVCON6 systems management platform contains an object-graph navigation language (OGNL) injection vulnerability that allows unauthenticated attackers to execute arbitrary commands by injecting malicious OGNL expressions. Attackers can send crafted requests to the login.action endpoint with OGNL payloads in the redirect parameter to instantiate ProcessBuilder objects and execute system commands with root privileges.
Weakness: CWE-1334
Which versions are affected by CVE-2018-25159?
How do I fix CVE-2018-25159?
No fix has been published for CVE-2018-25159 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2018-25159 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-25159 exists.
Sources
Also known as GHSA-mwjq-j75q-p7vm.