CVE-2015-2279: Airlive Bu-2015 Firmware

Critical severity, CVSS 9.8. EPSS: 17.6% chance of exploitation in the next 30 days.

cgi_test.cgi in AirLive BU-2015 with firmware 1.03.18, BU-3026 with firmware 1.43, and MD-3025 with firmware 1.81 allows remote attackers to execute arbitrary OS commands via shell metacharacters after an "&" (ampersand) in the write_mac write_pid, write_msn, write_tan, or write_hdv parameter.

Affected products

• Airlive Bu-2015 Firmware: version 1.03.18 only
• Airlive Bu-3026 Firmware: version 1.43 only
• Airlive Md-3025 Firmware: version 1.81 only

Published 2017-07-25. Last modified 2026-06-17.