Format string vulnerability in the _vsnsprintf function in rrobotd.exe in the Device Manager in EMC AlphaStor 4.0 before build 800 allows remote attackers to execute arbitrary code via format string specifiers in a command.
Vulnerabilidad en el formato de cadena en la función _vsnsprintf en rrobotd.exe en el Administrador de dispositivos de EMC AlphaStor v4.0 antes de build 800 que permite a atacantes remotos ejecutar código arbitrario a través de especificadores de formato de cadena en un comando.
This vulnerability potentially allows remote attackers to execute arbitrary code on vulnerable installations of EMC AlphaStor for EMC Networker. Authentication is not required to exploit this vulnerability.
The specific flaw exists within Device Manager (rrobotd.exe) which listens by default on port 3000. When parsing the 0x75 command, the process uses unfiltered user supplied data as a format string, allowing an attacker partial control over memory. Should an attacker leverage this vulnerability into remote execution of arbitrary code, that code would run with SYSTEM privileges.
