PT-2019-10273 · Hootoo · Hootoo Tripmate Titan

Publicado 2019-06-11 · Atualizado 2019-06-12 · CVE-2018-20841

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: HooToo TripMate Titan HT-TM05 and HT-05 routers with firmware 2.000.022 and 2.000.082

Description: The issue allows remote command execution via shell metacharacters in the mac parameter of a "protocol.csp?function=set&fname=security&opt=mac table" request.

Recommendations: For firmware 2.000.022, avoid using the mac parameter in the affected API endpoint until the issue is resolved. For firmware 2.000.082, restrict access to the vulnerable protocol.csp endpoint to minimize the risk of exploitation.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2018-20841

Produtos afetados

Hootoo Tripmate Titan

Referências · 4

• 🔥 https://exploit-db.com/exploits/46143 · Exploit
• 🔥 https://ioactive.com/hootoo-tripmate-routers-are-cute-but · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-20841 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-20841 · Aviso do Fabricante