PT-2019-16602 · Wifi Soft · Wifi-Soft Unibox Controller

Sahil Dhar · Publicado 2019-03-18 · Atualizado 2021-09-13 · CVE-2019-3497

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Wifi-soft UniBox controller versions 0.x through 2.x

Description An issue in the Diagnostic Tools component of the Wifi-soft UniBox controller allows for Remote Command Execution. This is due to the tools/ping Ping feature being vulnerable, enabling an attacker to execute arbitrary system commands on the server with root user privileges. The authentication for accessing this component can be bypassed by utilizing hard-coded credentials.

Recommendations For Wifi-soft UniBox controller versions 0.x through 2.x, consider disabling the tools/ping Ping feature in the Diagnostic Tools component until a patch is available to prevent Remote Command Execution. Restrict access to the Diagnostic Tools component to minimize the risk of exploitation. Avoid using hard-coded credentials for authentication.

Exploit

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2019-3497

Produtos afetados

Wifi-Soft Unibox Controller

Referências · 4

• 🔥 http://packetstormsecurity.com/files/151077/Wifi-soft-Unibox-2.x-Remote-Command-Code-Injection.html · Exploit
• 🔥 https://sahildhar.github.io/blogpost/Multiple-RCE-Vulnerabilties-in-Unibox-Controller-0.x-3.x · Exploit
• 🔥 http://seclists.org/fulldisclosure/2019/Jan/23 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-3497 · Nota de Segurança