CVE-2012-10039

published 2025-08-11

CVE-2012-10039: ZEN Load Balancer versions 2.0 and 3.0-rc1 contain a command injection vulnerability in content2-2.cgi. The filelog parameter is passed directly into a…

Priority P2 72 critical 9.4 CVSS 4.0

AV N AC L AT N PR L UI N VC H VI H VA H SC H SI H SA H E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

EXPLOIT

ZEN Load Balancer versions 2.0 and 3.0-rc1 contain a command injection vulnerability in content2-2.cgi. The filelog parameter is passed directly into a backtick-delimited exec() call without sanitation. An authenticated attacker can inject arbitrary shell commands, resulting in remote code execution as the root user. ZEN Load Balancer is the predecessor of ZEVENET and SKUDONET. The affected versions (2.0 and 3.0-rc1) are no longer supported. SKUDONET CE is the current community-maintained successor.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
zen_load_balancer	zen_load_balancer	—	—
zen_load_balancer	zen_load_balancer	—	—

Detection & IOCs extracted from sources · hover to see the quote

path /content2-2.cgi↗

other filelog↗

• → Monitor HTTP requests to /content2-2.cgi containing shell metacharacters (backticks, semicolons, pipes, $(), etc.) in the 'filelog' parameter, which indicates command injection attempts. ↗
• → Alert on any process spawned as root originating from a CGI process (content2-2.cgi) on ZEN Load Balancer 2.0 or 3.0-rc1, as successful exploitation results in RCE as root. ↗
• → The filelog parameter is passed directly into a backtick-delimited exec() call without sanitation — look for unsanitized OS command execution patterns in CGI scripts on ZEN Load Balancer appliances. ↗

• · Exploitation requires prior authentication; unauthenticated attackers cannot directly exploit this vulnerability. ↗
• · Only ZEN Load Balancer versions 2.0 and 3.0-rc1 are affected; these versions are no longer supported. Successor products (SKUDONET CE, ZEVENET) are not listed as affected. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78