Andrea Fabrizi has reported two vulnerabilities in Visual Tools VS, which can be exploited by malicious people to disclose sensitive information and potentially compromise a vulnerable system.

1) The application provides unrestricted access to the cgi-bin/util/ziplogs.py script, which can be exploited to obtain an access to logs.zip file via a specially crafted HTTP GET request.

2) The application provides unrestricted access to the cgi-bin/conf/recv_ip_filtering.py script, which can be exploited to execute arbitrary shell commands via a specially crafted HTTP POST request.

The vulnerabilities are reported in version 3.0.6.16. Other versions may also be affected.

Solution
No official solution is currently available.
Original Advisory
http://seclists.org/fulldisclosure/2012/Oct/107

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers