PT-2009-6360 · Huawei · Huawei Mt882

Decodex01 · Published 2009-12-04 · Updated 2017-08-17 · CVE-2009-4196

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Huawei MT882 V100R002B020 ARG-T version 3.7.9.98

Description The issue allows remote attackers to inject arbitrary web script or HTML via multiple parameters in various scripts. The affected parameters include BackButton to "error 1", wzConnFlag to "fresh pppoe 1", diag pppindex argen and DiagStartFlag to "rpDiag argen 1", wzdmz active and wzdmzHostIP to "rpNATdmz argen 1", wzVIRTUALSVR endPort, wzVIRTUALSVR endPortLocal, wzVIRTUALSVR IndexFlag, wzVIRTUALSVR localIP, wzVIRTUALSVR startPort, and wzVIRTUALSVR startPortLocal to "rpNATvirsvr argen 1", Connect DialFlag, Connect DialHidden, and Connect Flag to "rpStatus argen 1", Telephone select and wzFirstFlag to "rpwizard 1", and wzConnectFlag to "rpwizPppoe 1".

Recommendations To resolve the issue, update the firmware to a version that includes the fix for this problem. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2009-4196

Affected Products

Huawei Mt882

References · 5

• 🔥 http://exploit-db.com/exploits/10276 · Exploit
• 🔥 https://exploit-db.com/exploits/10276 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-4196 · Security Note
• http://securityfocus.com/bid/37194 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54526 · Note