PT-2017-6327 · Zhone · Znid Gpon 2426A

Lyon Yang · Published 2017-10-17 · Updated 2022-04-14 · CVE-2014-9118

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zhone zNID GPON 2426A versions prior to S3.0.501

Description The issue concerns the web administrative portal, where remote attackers can execute arbitrary commands. This is achieved by using shell metacharacters in the ipAddr parameter to the "zhnping.cmd" endpoint.

Recommendations For versions prior to S3.0.501, update to version S3.0.501 or later to resolve the issue. As a temporary workaround, consider restricting access to the "zhnping.cmd" endpoint to minimize the risk of exploitation. Avoid using the ipAddr parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2014-9118

Affected Products

Znid Gpon 2426A

References · 6

• 🔥 http://packetstormsecurity.com/files/133921/Zhone-Insecure-Reference-Password-Disclosure-Command-Injection.html · Exploit
• 🔥 https://exploit-db.com/exploits/38453 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2015/Oct/57 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-9118 · Security Note
• https://t.me/nekaspersky/2117 · Telegram Post
• http://securityfocus.com/archive/1/536663/100/0/threaded · Note