PT-2018-12442 · Alcatel · Alcatel Osprey3 Mini

Osanda Malith Jayathissa + 1 · Publicado 2018-09-26 · Atualizado 2019-10-03 · CVE-2018-14327

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Alcatel OSPREY3 MINI Modem component on EE EE40VB 4G mobile broadband modems with firmware prior to EE40 00 02.00 45

Description The issue concerns weak permissions set by the installer for certain directories, allowing local users to gain privileges. This is demonstrated by the potential to insert a Trojan horse ServiceManager.exe file into the "Web ConnectonEE40BackgroundService" directory.

Recommendations For firmware versions prior to EE40 00 02.00 45, update the firmware to EE40 00 02.00 45 or later to resolve the issue.

Exploit

Correção

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

CVE-2018-14327

Produtos afetados

Alcatel Osprey3 Mini

Referências · 7

• 🔥 https://exploit-db.com/exploits/45501 · Exploit
• 🔥 http://packetstormsecurity.com/files/149492/EE-4GEE-Mini-Local-Privilege-Escalation.html · Exploit
• 🔥 http://blog.zerodaylab.com/2018/09/zerodaylab-discovers-ee-unquoted.html · Exploit
• 🔥 https://osandamalith.com/2018/09/17/ee-4gee-mini-local-privilege-escalation-vulnerability-cve-2018-14327 · Exploit
• http://securityfocus.com/bid/105385 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-14327 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-14327 · Aviso do Fabricante