PT-2019-16601 · Wifi Soft · Wifi-Soft Unibox Controller

Publicado 2019-03-18 · Atualizado 2021-09-13 · CVE-2019-3496

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Wifi-soft UniBox controller versions 3.x

Description A Remote Command Execution issue was discovered in the Diagnostic Tools Controller, allowing an attacker to execute arbitrary system commands on the server with root user privileges. The authentication for accessing this component can be bypassed by using hard-coded credentials.

Recommendations For Wifi-soft UniBox controller versions 3.x, as a temporary workaround, consider disabling the Diagnostic Tools Controller until a patch is available. Restrict access to the Diagnostic Tools Controller to minimize the risk of exploitation. Avoid using hard-coded credentials in the Diagnostic Tools Controller until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2019-3496

Produtos afetados

Wifi-Soft Unibox Controller

Referências · 4

• 🔥 http://packetstormsecurity.com/files/151077/Wifi-soft-Unibox-2.x-Remote-Command-Code-Injection.html · Exploit
• 🔥 https://sahildhar.github.io/blogpost/Multiple-RCE-Vulnerabilties-in-Unibox-Controller-0.x-3.x · Exploit
• 🔥 http://seclists.org/fulldisclosure/2019/Jan/23 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-3496 · Nota de Segurança