PT-2019-12238 · Motorola · Motorola M2+1

Publicado 2019-04-18 · Atualizado 2020-08-24 · CVE-2019-11322

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Motorola CX2 version 1.01 Motorola M2 version 1.01

Description An issue was discovered that leads to remote code execution via shell metacharacters in a JSON value. This is due to a command injection in the startRmtAssist function in hnap.

Recommendations For Motorola CX2 version 1.01, consider disabling the startRmtAssist function in hnap to prevent command injection until a patch is available. For Motorola M2 version 1.01, consider disabling the startRmtAssist function in hnap to prevent command injection until a patch is available.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2019-11322

Produtos afetados

Motorola Cx2

Motorola M2

Referências · 3

• 🔥 https://github.com/TeamSeri0us/pocs/blob/master/iot/motorola.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-11322 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-11322 · Aviso do Fabricante