PT-2026-24781 · Sapido · Rb-1732

K1Nm3N.Aotoi · Publicado 2026-03-11 · Atualizado 2026-03-11 · CVE-2019-25487

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAPIDO RB-1732 version 2.0.43

Description The device contains a remote command execution issue that allows attackers to execute arbitrary system commands without authentication. Attackers can send malicious input to the formSysCmd API endpoint. Specifically, attackers can send POST requests with the sysCmd parameter containing shell commands to execute code on the device with router privileges.

Recommendations Apply input validation to the sysCmd parameter of the formSysCmd API endpoint. Restrict access to the formSysCmd endpoint. Disable the formSysCmd endpoint if it is not essential for device operation.

Exploit

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2019-25487

Produtos afetados

Rb-1732

Referências · 4

• 🔥 https://exploit-db.com/exploits/47031 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25487 · Nota de Segurança
• https://vulncheck.com/advisories/sapido-rb-remote-command-execution-via-formsyscmd · Nota
• https://vulncheck.com/advisories/sapido-rb-1732-remote-command-execution-via-formsyscmd · Nota