PT-2016-3221 · Netcomm Wireless · Netcommwireless Hspa 3G10Wve

Bhadresh Patel · Publicado 2016-05-03 · Atualizado 2018-10-09 · CVE-2015-6024

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions NetCommWireless HSPA 3G10WVE wireless routers versions prior to firmware 3G10WVE-L101-S306ETS-C01 R05

Description The issue is related to the ping.cgi script in the router's firmware, which lacks proper input sanitization. This allows a remote authenticated user to execute arbitrary commands by injecting shell metacharacters into the DIA IPADDRESS parameter.

Recommendations For versions prior to firmware 3G10WVE-L101-S306ETS-C01 R05, update the firmware to version 3G10WVE-L101-S306ETS-C01 R05 or later to resolve the issue. As a temporary workaround, consider restricting access to the ping.cgi script until the firmware can be updated. Avoid using the DIA IPADDRESS parameter in the ping.cgi script with untrusted input until the issue is resolved.

Exploit

Correção

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

BDU:2017-02589

CVE-2015-6024

Produtos afetados

Netcommwireless Hspa 3G10Wve

Referências · 10

• 🔥 https://exploit-db.com/exploits/39762 · Exploit
• http://securityfocus.com/archive/1/538263/100/0/threaded · Nota
• http://seclists.org/fulldisclosure/2016/May/18 · Nota
• http://seclists.org/fulldisclosure/2016/May/13 · Nota
• http://packetstormsecurity.com/files/136901/NetCommWireless-HSPA-3G10WVE-Authentication-Bypass-Code-Execution.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-6024 · Nota de Segurança
• http://securityfocus.com/archive/1/archive/1/538263/100/0/threaded · Nota
• http://securityfocus.com/archive/1/archive/1/538297/100/0/threaded · Nota
• https://bdu.fstec.ru/vul/2017-02589 · Nota de Segurança
• http://securityfocus.com/archive/1/538297/100/0/threaded · Nota