PT-2019-14235 · Openwrt · Libuci+1

Publicado 2019-08-23 · Atualizado 2021-01-03 · CVE-2019-15513

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions OpenWrt libuci versions prior to 15.05.1

Description An issue was discovered in OpenWrt libuci, where /tmp/.uci/network locking is mishandled after reception of a long SetWanSettings command, leading to a device hang.

Recommendations For versions prior to 15.05.1, update to version 15.05.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the SetWanSettings command to minimize the risk of exploitation.

Exploit

Correção

Improper Locking

Enumeração de Fraquezas

CWE-667

Identificadores relacionados

CVE-2019-15513

Produtos afetados

Openwrt

Libuci

Referências · 7

• 🔥 https://github.com/TeamSeri0us/pocs/blob/master/iot/morouter/motorola%E8%B7%AF%E7%94%B1%E5%99%A8%E6%96%87%E4%BB%B6%E8%A7%A3%E9%94%81%E6%BC%8F%E6%B4%9E.pdf · Exploit
• https://lists.openwrt.org/pipermail/openwrt-devel/2019-November/025453.html · Nota
• https://t.me/cvenotify/8111 · Publicação no Telegram
• https://git.openwrt.org/?p=project/uci.git%3Ba=commitdiff%3Bh=19e29ffc15dbd958e8e6a648ee0982c68353516f · Nota
• https://lists.infradead.org/pipermail/openwrt-devel/2019-November/019736.html · Nota
• https://osv.dev/vulnerability/CVE-2019-15513 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-15513 · Nota de Segurança