source: https://www.securityfocus.com/bid/44421/info NitroView ESM is prone to a remote command-execution vulnerability because it fails to adequately sanitize user-supplied input. Successful attacks may allow an attacker to execute arbitrary commands on the appliance in the context of the webserver process. NitroView ESM 8.4.0a is affected; other versions may also be vulnerable.

 [*] Tested on v8.4.0a "NitroSecurity 2.6.22.19-24nssmp64 GNU/Linux" [*] No authentication required [*] "ESSPMDebug=1" in "/usr/local/ess/CPConsoleServer.cfg" required