PT-2017-2798 · Technicolor · Technicolor Td5336

Published 2017-04-09 · Updated 2017-09-08 · CVE-2017-14127

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Technicolor TD5336 OI Fw v7

Description The issue is related to command injection in the Ping Module of the Web Interface. It allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the pingAddr parameter to "mnt ping.cgi". This is due to the lack of neutralization of special elements used in the operating system command. Exploitation of this issue may allow a remote attacker to execute arbitrary operating system commands with superuser privileges using shell metacharacters.

Recommendations For Technicolor TD5336 OI Fw v7, as a temporary workaround, consider restricting access to the "mnt ping.cgi" service to minimize the risk of exploitation. Avoid using the pingAddr parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2017-02065

CVE-2017-14127

Affected Products

Technicolor Td5336

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2017-14127 · Security Note
• https://bdu.fstec.ru/vul/2017-02065 · Security Note
• https://osv.dev/vulnerability/CVE-2017-14127 · Vendor Advisory
• https://vuldb.com/?id.106103 · Note
• http://cvedetails.com/cve/CVE-2017-14127 · Note
• http://jordyf.me/2017/09/02/technicolor-pwn.html · Note