PT-2017-18717 · Mimosa · Mimosa Backhaul Radios+1

Published 2017-05-21 · Updated 2017-05-26 · CVE-2017-9135

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mimosa Client Radios versions prior to 2.2.4 Mimosa Backhaul Radios versions prior to 2.2.4

Description An issue was discovered on the backend of the device's web interface, where some diagnostic tests are not displayed on the webpage but are accessible by crafting a POST request. One of these tests does not properly sanitize user input, allowing an attacker to execute shell commands as the root user.

Recommendations For Mimosa Client Radios versions prior to 2.2.4, update to version 2.2.4 or later. For Mimosa Backhaul Radios versions prior to 2.2.4, update to version 2.2.4 or later.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2017-9135

Affected Products

Mimosa Backhaul Radios

Mimosa Client Radios

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-9135 · Security Note
• https://osv.dev/vulnerability/CVE-2017-9135 · Vendor Advisory
• http://blog.iancaling.com/post/160596244178 · Note