Vulnerability record · CVE-2012-0262 · published 31 December 2013
CVE-2012-0262: op5 Monitor op5config command injection via password parameter
Op5 · Monitor
The op5config/welcome component in system-op5config before 2.0.3 in op5 Monitor and op5 Appliance before 5.5.3 passes the password parameter to a shell without sanitizing shell metacharacters. A remote attacker can therefore inject and execute arbitrary commands on the affected host. The flaw is rated CVSS v2 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C), so it is a full compromise of confidentiality, integrity and availability.
Description
op5config/welcome in system-op5config before 2.0.3 in op5 Monitor and op5 Appliance before 5.5.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the password parameter.
AV:N/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
critical priorityUnauthenticated remote command execution with a CVSS v2 score of 10.0 and high EPSS probability, though no KEV listing.
What it is
The op5config/welcome component in system-op5config before 2.0.3 in op5 Monitor and op5 Appliance before 5.5.3 passes the password parameter to a shell without sanitizing shell metacharacters. A remote attacker can therefore inject and execute arbitrary commands on the affected host. The flaw is rated CVSS v2 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C), so it is a full compromise of confidentiality, integrity and availability.
Impact
An unauthenticated remote attacker gains arbitrary command execution on the op5 Monitor or op5 Appliance host, typically with the privileges of the web/config service. That allows full control of the monitoring server, including data theft, tampering and service disruption.
Attack surface
Reached over the network through the op5config/welcome endpoint, per the AV:N vector. The CVSS vector shows Au:N, so no authentication is required, and the description indicates no user interaction beyond sending the crafted password parameter.
Exploitation
Not listed in CISA KEV and no ransomware associations are recorded, but EPSS is 0.72851 (99.4th percentile) and a reference is tagged Exploit, indicating public exploit material exists and exploitation is likely.
What to do
- Upgrade system-op5config to 2.0.3 or later and op5 Monitor/op5 Appliance to the fixed versions referenced in the vendor advisory.
- If immediate patching is not possible, restrict network access to the op5config/welcome endpoint to trusted management hosts only.
- Validate and reject shell metacharacters in the password parameter at any proxy or WAF in front of the interface.
- Run the op5 web/config service with least privilege and isolate the monitoring host from general user networks.
- Review the vendor advisory and bug 5094 for any additional fixed components before closing the finding.
Detection
- Monitor web/proxy logs for requests to op5config/welcome containing shell metacharacters (;, |, $(), backticks) in the password parameter.
- Alert on unexpected child processes spawned by the op5 web/config service user, especially shells or command interpreters.
- Hunt for outbound connections or file writes originating from the op5 host that do not match normal monitoring behavior.
- Correlate authentication-free access to op5config/welcome with subsequent process creation events on the same host.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2012-0262 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2012-0262), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
