PT-2023-32604 · Tecno · Tecno 4G Portable Wifi Tr118

Allan Njuguna · Publicado 2023-11-27 · Atualizado 2024-05-17 · CVE-2023-6304

Positive Technologies (AI Summary)

CVSS v2.0

8.3

Alta

Vetor base

AV:N/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Tecno 4G Portable WiFi TR118 version TR118-M30E-RR-D-EnFrArSwHaPo-OP-V008-20220830

Description A critical issue has been identified, affecting the Ping Tool component, specifically the /goform/goform get cmd process file. The url argument is vulnerable to os command injection, which can be exploited remotely. The issue has been publicly disclosed.

Recommendations For version TR118-M30E-RR-D-EnFrArSwHaPo-OP-V008-20220830, as a temporary workaround, consider restricting access to the Ping Tool component, specifically the /goform/goform get cmd process file, to minimize the risk of exploitation. Avoid using the url argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2023-6304

Produtos afetados

Tecno 4G Portable Wifi Tr118

Referências · 6

• 🔥 https://drive.google.com/file/d/1DUSlAxTbNLBdv1aLUAn-tDMu6Z1rHYH8/view · Exploit
• https://osv.dev/vulnerability/CVE-2023-6304 · Aviso do Fabricante
• https://vuldb.com/?id.246130 · Nota
• https://vuldb.com/?ctiid.246130 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-6304 · Nota de Segurança
• https://t.me/pentestingnews/41431 · Publicação no Telegram