PT-2018-6585 · Openwrt+1 · Openwrt+2

Neonsea · Publicado 2018-01-04 · Atualizado 2019-10-03 · CVE-2017-17867

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Inteno iopsys versions 2.0 through 3.14 Inteno iopsys version 4.0

Description: The issue allows remote authenticated users to execute arbitrary OS commands by modifying the leasetrigger field in the odhcpd configuration. This can be done to specify an arbitrary program, such as one located on an SMB share. The problem exists due to the improper use of the /etc/uci-defaults directory, which fails to secure the OpenWrt configuration.

Recommendations: For Inteno iopsys versions 2.0 through 3.14, update the configuration to properly utilize the /etc/uci-defaults directory for securing OpenWrt. For Inteno iopsys version 4.0, update the configuration to properly utilize the /etc/uci-defaults directory for securing OpenWrt. As a temporary workaround, consider restricting access to the odhcpd configuration to minimize the risk of exploitation.

Exploit

Correção

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

CVE-2017-17867

Produtos afetados

Inteno Iopsys

Openwrt

Odhcpd

Referências · 5

• 🔥 https://exploit-db.com/exploits/43428 · Exploit
• 🔥 https://neonsea.uk/blog/2017/12/23/rce-inteno-iopsys.html · Exploit
• http://public.inteno.se/?p=feed-inteno-openwrt.git%3Ba=commit%3Bh=efcc985a721107e72a66da4db66891ec54441998 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-17867 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-17867 · Aviso do Fabricante