PT-2019-18381 · Rdk · Ccspwifiagent

Publicado 2019-06-20 · Atualizado 2020-08-24 · CVE-2019-6962

Positive Technologies (AI Summary)

CVSS v2.0

8.5

Alta

Vetor base

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions RDK RDKB-20181217-1 CcspWifiAgent module (affected versions not specified)

Description A shell injection issue in the CcspWifiAgent module allows attackers with login credentials to execute arbitrary shell commands under the CcspWifiSsp process, which runs as root. This issue is related to the WebUI module and can be exploited by changing the Wi-Fi network password to include crafted escape characters, but only if the platform was compiled with the ENABLE FEATURE MESHWIFI macro.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2019-6962

Produtos afetados

Ccspwifiagent

Referências · 3

• https://dojo.bullguard.com/dojo-by-bullguard/blog/the-gateway-is-wide-open · Nota
• https://osv.dev/vulnerability/CVE-2019-6962 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-6962 · Nota de Segurança