PT-2019-8307 · Billion · Billion 5200W-T

Pedro Ribeiro · Publicado 2019-05-02 · Atualizado 2019-10-03 · CVE-2017-18372

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Billion 5200W-T TCLinux Fw version 7.3.8.0 v008 130603

Description The issue concerns a command injection vulnerability in the Time Setting function of the Billion 5200W-T TCLinux Fw router. This vulnerability is located in the tools time.asp page and can be exploited through the uiViewSNTPServer parameter. It is notable that access to this function requires authentication.

Recommendations For Billion 5200W-T TCLinux Fw version 7.3.8.0 v008 130603, as a temporary workaround, consider restricting access to the tools time.asp page and avoid using the uiViewSNTPServer parameter until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2017-18372

Produtos afetados

Billion 5200W-T

Referências · 6

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/trueonline_billion_5200w_rce.rb · Exploit
• 🔥 https://ssd-disclosure.com/index.php/archives/2910 · Exploit
• 🔥 https://seclists.org/fulldisclosure/2017/Jan/40 · Exploit
• 🔥 https://raw.githubusercontent.com/pedrib/PoC/master/advisories/zyxel_trueonline.txt · Exploit
• https://osv.dev/vulnerability/CVE-2017-18372 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-18372 · Nota de Segurança