Root file overwrite via Nmap argument injection

Argument injection in Device42 Main Appliance before 17.05.01 allows remote authenticated users to overwrite arbitrary files on a Remote Collector. The Nmap Discovery utility passes unsanitized job input as an extra Nmap argument, enabling a root-run collector process to replace attacker-chosen files. The attacker must hold permission to add or edit Nmap Discovery jobs; the resulting write occurs with root privileges and can corrupt collector data or system files.