PT-2019-16769 · Verizon · Verizon Fios Quantum Gateway

Publicado 2019-04-11 · Atualizado 2020-08-24 · CVE-2019-3914

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Verizon Fios Quantum Gateway (G1100) version 02.01.00.05

Description A remote command injection issue allows a remote, authenticated attacker to execute arbitrary commands on the target device. This can be achieved by adding an access control rule for a network object with a crafted hostname.

Recommendations For version 02.01.00.05, as a temporary workaround, consider restricting access to the network object configuration to minimize the risk of exploitation. Avoid using crafted hostnames in access control rules until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2019-3914

Produtos afetados

Verizon Fios Quantum Gateway

Referências · 3

• 🔥 https://tenable.com/security/research/tra-2019-17 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-3914 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-3914 · Aviso do Fabricante