PT-2017-18715 · Mimosa · Mimosa Backhaul Radios+1

Publicado 2017-05-21 · Atualizado 2017-05-26 · CVE-2017-9133

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mimosa Client Radios versions prior to 2.2.3 Mimosa Backhaul Radios versions prior to 2.2.3

Description An issue was discovered in the device's web interface, where a page allows users to ping other hosts and view the results. The host variable is not sanitized server-side, allowing an attacker to pass a specially crafted string and execute shell commands as the root user.

Recommendations For Mimosa Client Radios versions prior to 2.2.3, update to version 2.2.3 or later. For Mimosa Backhaul Radios versions prior to 2.2.3, update to version 2.2.3 or later.

Correção

Special Elements Injection

Enumeração de Fraquezas

CWE-74

Identificadores relacionados

CVE-2017-9133

Produtos afetados

Mimosa Backhaul Radios

Mimosa Client Radios

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-9133 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-9133 · Aviso do Fabricante
• http://blog.iancaling.com/post/160596244178 · Nota