PT-2017-18717 · Mimosa · Mimosa Backhaul Radios+1

Publicado 2017-05-21 · Atualizado 2017-05-26 · CVE-2017-9135

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mimosa Client Radios versions prior to 2.2.4 Mimosa Backhaul Radios versions prior to 2.2.4

Description An issue was discovered on the backend of the device's web interface, where some diagnostic tests are not displayed on the webpage but are accessible by crafting a POST request. One of these tests does not properly sanitize user input, allowing an attacker to execute shell commands as the root user.

Recommendations For Mimosa Client Radios versions prior to 2.2.4, update to version 2.2.4 or later. For Mimosa Backhaul Radios versions prior to 2.2.4, update to version 2.2.4 or later.

Correção

Special Elements Injection

Enumeração de Fraquezas

CWE-74

Identificadores relacionados

CVE-2017-9135

Produtos afetados

Mimosa Backhaul Radios

Mimosa Client Radios

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-9135 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-9135 · Aviso do Fabricante
• http://blog.iancaling.com/post/160596244178 · Nota