PT-2019-15393 · Technicolor · Td5130V2

Publicado 2019-10-31 · Atualizado 2020-02-10 · CVE-2019-18396

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Technicolor TD5130v2 devices with Oi third-party firmware OI Fw V20

Description A Command Injection issue in the Ping module of the Web Interface allows remote attackers to execute arbitrary OS commands. This is achieved by exploiting the pingAddr parameter in the "mnt ping.cgi" endpoint.

Recommendations For Technicolor TD5130v2 devices with Oi third-party firmware OI Fw V20, avoid using the pingAddr parameter in the "mnt ping.cgi" endpoint until a fix is available. As a temporary workaround, consider restricting access to the Ping module in the Web Interface to minimize the risk of exploitation.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2019-18396

Produtos afetados

Td5130V2

Referências · 8

• 🔥 https://medium.com/@c4pt41nnn/cve-2019-18396-command-injection-in-technicolor-router-da5dd2134052 · Exploit
• 🔥 https://exploit-db.com/exploits/47651 · Exploit
• 🔥 https://packetstormsecurity.com/files/155296/Technicolor-TD5130.2-Remote-Command-Execution.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-18396 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-18396 · Aviso do Fabricante
• https://medium.com/%40c4pt41nnn/cve-2019-18396-command-injection-in-technicolor-router-da5dd2134052 · Nota
• http://packetstormsecurity.com/files/155296/Technicolor-TD5130.2-Remote-Command-Execution.html · Nota
• https://twitter.com/c4pt41nnn · Nota