PT-2018-13083 · Actiontec · Actiontec T2200H

Publicado 2018-08-20 · Atualizado 2018-11-01 · CVE-2018-15553

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Actiontec T2200H version T2200H-31.128L.03

Description The issue allows OS Command Injection via shell metacharacters in the smbdUserid or smbdPasswd field of the fileshare.cmd on the affected device.

Recommendations For version T2200H-31.128L.03, as a temporary workaround, consider restricting access to the fileshare.cmd to minimize the risk of exploitation. Avoid using shell metacharacters in the smbdUserid or smbdPasswd field until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2018-15553

Produtos afetados

Actiontec T2200H

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-15553 · Nota de Segurança
• http://seclists.org/fulldisclosure/2016/Aug/75 · Nota
• https://osv.dev/vulnerability/CVE-2018-15553 · Aviso do Fabricante