PT-2016-3200 · Airlink · Air:Link 59300+2

Published 2016-12-26 · Updated 2017-04-10 · CVE-2016-10312

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Air:Link 3G (AL3G) version 2.23m (Rev. 3) Air:Link 5000AC (AL5000AC) version 1.13 Air:Link 59300 (AL59300) version 1.04 (Rev. 4)

Description The issue is related to the lack of data sanitization on the management level of the AirLink router firmware. This can be exploited by a remote attacker to execute arbitrary commands using shell metacharacters on certain pages, such as "/goform/*" pages.

Recommendations For Air:Link 3G (AL3G) version 2.23m (Rev. 3), update to a version that addresses the issue of shell metacharacter injection in /goform/* pages. For Air:Link 5000AC (AL5000AC) version 1.13, update to a version that addresses the issue of shell metacharacter injection in /goform/* pages. For Air:Link 59300 (AL59300) version 1.04 (Rev. 4), update to a version that addresses the issue of shell metacharacter injection in /goform/* pages. As a temporary workaround, consider restricting access to the /goform/* pages until a patch is available.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2017-02464

CVE-2016-10312

Affected Products

Air:Link 3G

Air:Link 5000Ac

Air:Link 59300

References · 4

• 🔥 https://riskbasedsecurity.com/research/RBS-2016-004.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2016-10312 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-02464 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-10312 · Security Note