PT-2017-3431 · Cohu · Cohu 3960Hd
Jeremy Johnson
·
Publicado
2017-11-22
·
Atualizado
2017-12-12
·
CVE-2017-8862
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Cohu 3960HD (affected versions not specified)
Description
The issue concerns the webupgrade function, which does not properly verify firmware upgrade files or the upgrade process. This allows an attacker to upload a specially crafted postinstall.sh file that will be executed with root privileges. The vulnerability is related to unrestricted file upload of dangerous types, enabling a remote attacker to execute arbitrary code with root privileges by uploading a specially formed archive containing the postinstall.sh file.
Recommendations
As a temporary workaround, consider disabling the webupgrade function until a patch is available.
Restrict access to the Cohu 3960HD to minimize the risk of exploitation.
Avoid using the webupgrade function to upload firmware until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Unrestricted File Upload
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Cohu 3960Hd