PT-2017-18715 · Mimosa · Mimosa Backhaul Radios+1

Published 2017-05-21 · Updated 2017-05-26 · CVE-2017-9133

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mimosa Client Radios versions prior to 2.2.3 Mimosa Backhaul Radios versions prior to 2.2.3

Description An issue was discovered in the device's web interface, where a page allows users to ping other hosts and view the results. The host variable is not sanitized server-side, allowing an attacker to pass a specially crafted string and execute shell commands as the root user.

Recommendations For Mimosa Client Radios versions prior to 2.2.3, update to version 2.2.3 or later. For Mimosa Backhaul Radios versions prior to 2.2.3, update to version 2.2.3 or later.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2017-9133

Affected Products

Mimosa Backhaul Radios

Mimosa Client Radios

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-9133 · Security Note
• https://osv.dev/vulnerability/CVE-2017-9133 · Vendor Advisory
• http://blog.iancaling.com/post/160596244178 · Note