PT-2016-3200 · Airlink · Air:Link 59300+2

Publicado 2016-12-26 · Atualizado 2017-04-10 · CVE-2016-10312

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Air:Link 3G (AL3G) version 2.23m (Rev. 3) Air:Link 5000AC (AL5000AC) version 1.13 Air:Link 59300 (AL59300) version 1.04 (Rev. 4)

Description The issue is related to the lack of data sanitization on the management level of the AirLink router firmware. This can be exploited by a remote attacker to execute arbitrary commands using shell metacharacters on certain pages, such as "/goform/*" pages.

Recommendations For Air:Link 3G (AL3G) version 2.23m (Rev. 3), update to a version that addresses the issue of shell metacharacter injection in /goform/* pages. For Air:Link 5000AC (AL5000AC) version 1.13, update to a version that addresses the issue of shell metacharacter injection in /goform/* pages. For Air:Link 59300 (AL59300) version 1.04 (Rev. 4), update to a version that addresses the issue of shell metacharacter injection in /goform/* pages. As a temporary workaround, consider restricting access to the /goform/* pages until a patch is available.

Exploit

Correção

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

BDU:2017-02464

CVE-2016-10312

Produtos afetados

Air:Link 3G

Air:Link 5000Ac

Air:Link 59300

Referências · 4

• 🔥 https://riskbasedsecurity.com/research/RBS-2016-004.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2016-10312 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2017-02464 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2016-10312 · Nota de Segurança