PT-2009-6360 · Huawei · Huawei Mt882

Decodex01 · Publicado 2009-12-04 · Atualizado 2017-08-17 · CVE-2009-4196

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Huawei MT882 V100R002B020 ARG-T version 3.7.9.98

Description The issue allows remote attackers to inject arbitrary web script or HTML via multiple parameters in various scripts. The affected parameters include BackButton to "error 1", wzConnFlag to "fresh pppoe 1", diag pppindex argen and DiagStartFlag to "rpDiag argen 1", wzdmz active and wzdmzHostIP to "rpNATdmz argen 1", wzVIRTUALSVR endPort, wzVIRTUALSVR endPortLocal, wzVIRTUALSVR IndexFlag, wzVIRTUALSVR localIP, wzVIRTUALSVR startPort, and wzVIRTUALSVR startPortLocal to "rpNATvirsvr argen 1", Connect DialFlag, Connect DialHidden, and Connect Flag to "rpStatus argen 1", Telephone select and wzFirstFlag to "rpwizard 1", and wzConnectFlag to "rpwizPppoe 1".

Recommendations To resolve the issue, update the firmware to a version that includes the fix for this problem. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2009-4196

Produtos afetados

Huawei Mt882

Referências · 5

• 🔥 http://exploit-db.com/exploits/10276 · Exploit
• 🔥 https://exploit-db.com/exploits/10276 · Exploit
• http://securityfocus.com/bid/37194 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54526 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-4196 · Nota de Segurança