Description
Network Attached Storage on LG N1T1*** 10124 devices allows an unauthenticated attacker to gain root access via OS command injection in the en/ajp/plugins/access.ssh/checkInstall.php destServer parameter.
References (3)
Core 3
Core References
Product, Vendor Advisory x_refsource_misc
https://www.lg.com/uk/support/product/lg-N1T1DD1
Product, Vendor Advisory x_refsource_misc
https://www.lg.com/us/burners-drives/lg-N1T1-network-attached-storage
Exploit, Third Party Advisory, URL Repurposed x_refsource_misc
https://zerosecuritypenetrationtesting.com/?page_id=306
Scores
CVSS v3
9.8
EPSS
0.0896
EPSS Percentile
94.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-78
Status
published
Products (1)
lg/n1t1_firmware
Published
Aug 24, 2021
Tracked Since
Feb 18, 2026