PT-2017-2909 · Edgewater Networks · Edgemarc

Published 2017-02-08 · Updated 2021-12-01 · CVE-2017-6079

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Edgewater Networks Edgemarc versions prior to the fixed version

Description The issue is related to the lack of input validation in the HTTP Web-Management component of the Edgewater Networks Edgemarc software. This allows a remote attacker to execute arbitrary commands using a hidden page as a web shell. The hidden page can be used to set user-defined commands, such as specific iptables routes. For example, the wget command can be executed. The vulnerability has been confirmed in firmware as old as 2006. The EwDoor botnet has been attacking US AT&T users through this vulnerability.

Recommendations For versions prior to the fixed version, consider disabling the web-management application until a patch is available. Restrict access to the hidden page that allows user-defined commands to minimize the risk of exploitation. Avoid using the web shell functionality until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2017-02233

CVE-2017-6079

Affected Products

Edgemarc

References · 7

• 🔥 https://github.com/MostafaSoliman/CVE-2017-6079-Blind-Command-Injection-In-Edgewater-Edgemarc-Devices-Exploit · Exploit
• 🔥 https://depthsecurity.com/blog/cve-2017-6079-blind-command-injection-in-edgewater-edgemarc-devices · Exploit
• 🔥 https://seebug.org/vuldb/ssvid-96933 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-6079 · Security Note
• https://bdu.fstec.ru/vul/2017-02233 · Security Note
• https://t.me/malwr/5453 · Telegram Post
• https://t.me/cvenotify/20743 · Telegram Post