PT-2017-2909 · Edgewater Networks · Edgemarc

Publicado 2017-02-08 · Atualizado 2021-12-01 · CVE-2017-6079

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Edgewater Networks Edgemarc versions prior to the fixed version

Description The issue is related to the lack of input validation in the HTTP Web-Management component of the Edgewater Networks Edgemarc software. This allows a remote attacker to execute arbitrary commands using a hidden page as a web shell. The hidden page can be used to set user-defined commands, such as specific iptables routes. For example, the wget command can be executed. The vulnerability has been confirmed in firmware as old as 2006. The EwDoor botnet has been attacking US AT&T users through this vulnerability.

Recommendations For versions prior to the fixed version, consider disabling the web-management application until a patch is available. Restrict access to the hidden page that allows user-defined commands to minimize the risk of exploitation. Avoid using the web shell functionality until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

BDU:2017-02233

CVE-2017-6079

Produtos afetados

Edgemarc

Referências · 7

• 🔥 https://github.com/MostafaSoliman/CVE-2017-6079-Blind-Command-Injection-In-Edgewater-Edgemarc-Devices-Exploit · Exploit
• 🔥 https://depthsecurity.com/blog/cve-2017-6079-blind-command-injection-in-edgewater-edgemarc-devices · Exploit
• 🔥 https://seebug.org/vuldb/ssvid-96933 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-6079 · Nota de Segurança
• https://t.me/malwr/5453 · Publicação no Telegram
• https://t.me/cvenotify/20743 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2017-02233 · Nota de Segurança