PT-2018-5084 · Hughes · Hn7740S+2

Publicado 2018-07-13 · Atualizado 2019-10-09 · CVE-2016-9494

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM

Description The issue is related to improper input validation. Specifically, the advanced status web page, which is linked to from the basic status web page, does not properly parse malformed GET requests, such as "/api/advanced status". This may lead to a denial of service.

Recommendations For Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, consider restricting access to the advanced status web page until a proper fix is available. As a temporary workaround, avoid using malformed GET requests to the affected web page. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2016-9494

Produtos afetados

Dw7000

Hn7000S/Sm

Hn7740S

Referências · 4

• https://osv.dev/vulnerability/CVE-2016-9494 · Aviso do Fabricante
• https://securityfocus.com/bid/96244 · Nota
• https://kb.cert.org/vuls/id/614751 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-9494 · Nota de Segurança