PT-2019-12901 · Zeroshell · Zeroshell

Juan Manuel Fernandez + 1 · Publicado 2019-07-19 · Atualizado 2024-06-06 · CVE-2019-12725

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zeroshell version 3.9.0

Description The issue occurs because the web application mishandles a few HTTP parameters, allowing an unauthenticated attacker to exploit this by injecting OS commands inside the vulnerable parameters. There has been an increase in scanning activity to exploit and compromise ZeroShell Linux router.

Recommendations For Zeroshell version 3.9.0, as a temporary workaround, consider restricting access to the web application to minimize the risk of exploitation. Avoid using the vulnerable HTTP parameters until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2019-12725

Produtos afetados

Zeroshell

Referências · 16

• 🔥 https://github.com/sma11new/PocList · Exploit
• 🔥 https://github.com/Sma11New/PocList · Exploit
• 🔥 https://github.com/hev0x/CVE-2019-12725-Command-Injection · Exploit
• 🔥 https://github.com/h3v0x/CVE-2019-12725-Command-Injection · Exploit
• 🔥 https://exploit-db.com/exploits/49096 · Exploit
• 🔥 https://tarlogic.com/advisories/zeroshell-rce-root.txt · Exploit
• 🔥 https://exploit-db.com/exploits/49862 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-12725 · Nota de Segurança
• https://t.me/cvenotify/6133 · Publicação no Telegram
• https://t.me/aptreports/4510 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2019-12725 · Aviso do Fabricante
• http://packetstormsecurity.com/files/162561/ZeroShell-3.9.0-Remote-Command-Execution.html · Nota
• http://packetstormsecurity.com/files/160211/ZeroShell-3.9.0-Remote-Command-Execution.html · Nota
• https://zeroshell.org/blog · Aviso do Fabricante
• https://t.me/ckure/4886 · Publicação no Telegram