Vulnerability record · CVE-2012-0261 · published 31 December 2013
CVE-2012-0261: op5 Monitor system-portal license.php command injection
Op5 · Monitor
The license.php script in op5 Monitor's system-portal (before 1.6.2) and op5 Appliance (before 5.5.3) passes the timestamp parameter of an install action to a shell without sanitizing shell metacharacters. An unauthenticated remote attacker can therefore inject and execute arbitrary commands on the server. This is a full compromise of confidentiality, integrity and availability on an internet-reachable monitoring appliance.
Description
license.php in system-portal before 1.6.2 in op5 Monitor and op5 Appliance before 5.5.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the timestamp parameter for an install action.
AV:N/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
critical priorityUnauthenticated remote command execution with a CVSS 2.0 base score of 10 and very high EPSS probability makes this an urgent patch target despite the absence of KEV listing.
What it is
The license.php script in op5 Monitor's system-portal (before 1.6.2) and op5 Appliance (before 5.5.3) passes the timestamp parameter of an install action to a shell without sanitizing shell metacharacters. An unauthenticated remote attacker can therefore inject and execute arbitrary commands on the server. This is a full compromise of confidentiality, integrity and availability on an internet-reachable monitoring appliance.
Impact
An attacker gains arbitrary command execution with the privileges of the web server, allowing data theft, configuration tampering, and use of the host as a pivot into the monitored network.
Attack surface
Reached over the network via HTTP requests to license.php with a crafted timestamp parameter; the CVSS vector (AV:N/AC:L/Au:N) indicates no authentication and no user interaction are required.
Exploitation
Not listed in CISA KEV and no public exploit tag is present in the references, but EPSS is very high (0.739 probability, 99.5th percentile), indicating strong likelihood of exploitation activity.
What to do
- Upgrade op5 Monitor to 1.6.2 or later and op5 Appliance to 5.5.3 or later, per the vendor advisory.
- If patching is not immediately possible, restrict network access to the system-portal/license.php endpoint to trusted management networks only.
- Place the op5 web interface behind authentication or a reverse proxy that blocks unauthenticated access to license.php.
- Review web server and application logs for shell metacharacter patterns in the timestamp parameter and treat any hits as compromise.
- Rotate credentials and audit the host for persistence if exploitation is suspected.
Detection
- Search HTTP access logs for requests to license.php containing shell metacharacters (;, |, `, $(), &&) in the timestamp parameter.
- Alert on unexpected child processes spawned by the op5 web server user (e.g., sh, bash, curl, wget).
- Monitor for outbound connections from the op5 host to unfamiliar addresses following license.php requests.
- Check file integrity of the op5 web root and system-portal files for unauthorized modification.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2012-0261 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2012-0261), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
