Cisco patch day fixes CGI script blunder, hard-coded credentials

If you've got a Cisco Unified Computing System or a Firepower 9000 Series appliance, get busy patching. The Borg says it slipped up and let a CGI script make unprotected calls to shell commands. By fooling around with the URL, an attacker would be able to send arbitrary commands to the affected kit. All versions of UCS …

[Hans 1]

WTF???? CGI ????

https://www.w3.org/Security/faq/wwwsf4.html

Some 17 years ago, w3 warned about the potential security hole CGI represents. 17 years AGO!!!!!!!

[teknopaul]

Re: WTF???? CGI ????

Better tell that to Facebook, lamp stack uses (fast)cgi, as do lots of other Web frameworks, the notion that scripts are insecure does not sit well with the JavaScript community. That link recommends C for Web facing code, me ☺ its a tad out of date

[teknopaul]

where is vulture south?

That OZ? we get 300mbs as standard domestic adsl in Barcelona