PT-2018-13047 · Ucopia · Ucopia Wireless Appliance

Publicado 2018-08-21 · Atualizado 2019-10-03 · CVE-2018-15481

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions UCOPIA Wireless Appliance firmware versions 5.1.x before 5.1.13

Description The issue is related to improper input sanitization within the restricted administration shell. This allows authenticated remote attackers to escalate their privileges by modifying the SSH configuration file. Specifically, attackers can add a LocalCommand to the file in the user home folder, enabling them to escape the shell.

Recommendations For firmware versions 5.1.x before 5.1.13, update to version 5.1.13 or later to resolve the issue. As a temporary workaround, consider restricting access to the SSH configuration file in the user home folder to prevent unauthorized modifications.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2018-15481

Produtos afetados

Ucopia Wireless Appliance

Referências · 3

• https://osv.dev/vulnerability/CVE-2018-15481 · Aviso do Fabricante
• https://securite.intrinsec.com/2018/08/20/cve-2018-15481-ucopia-wireless-appliance-restricted-shell-escape-5-1-13 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-15481 · Nota de Segurança