PT-2018-13042 · Mystrom · Mystrom Wifi Switch Eu

Almeroth + 1 · Publicado 2018-08-30 · Atualizado 2018-11-09 · CVE-2018-15477

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions myStrom WiFi Switch V1 versions prior to 2.66

Description The issue concerns a lack of sanitization for a parameter received from the cloud, which is then used in an OS command. This allows malicious servers to execute operating system commands on the device.

Recommendations For versions prior to 2.66, update to version 2.66 or later to resolve the issue.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2018-15477

Produtos afetados

Mystrom Wifi Switch Eu

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-15477 · Nota de Segurança
• https://swisscom.ch/content/dam/swisscom/de/about/nachhaltigkeit/digitale-schweiz/sicherheit/bug-bounty/files/cve-2018-15476ff.txt · Nota
• https://osv.dev/vulnerability/CVE-2018-15477 · Aviso do Fabricante