PT-2017-13263 · Eyesofnetwork · Eyesofnetwork

Publicado 2017-09-03 · Atualizado 2021-02-23 · CVE-2017-14119

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EyesOfNetwork web interface (eonweb) versions 5.1-0

Description The issue is related to the module tool all/tools/snmpwalk.php in the EyesOfNetwork web interface, which does not properly restrict popen calls. This allows remote attackers to execute arbitrary commands via shell metacharacters in a parameter.

Recommendations For EyesOfNetwork web interface (eonweb) versions 5.1-0, consider restricting access to the vulnerable module tool all/tools/snmpwalk.php to minimize the risk of exploitation. Avoid using parameters that may contain shell metacharacters in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2017-14119

Produtos afetados

Eyesofnetwork

Referências · 4

• 🔥 http://kk.whitecell-club.org/index.php/archives/220 · Exploit
• https://osv.dev/vulnerability/CVE-2017-14119 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14119 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-14119 · Nota de Segurança