PT-2018-12442 · Alcatel · Alcatel Osprey3 Mini

Osanda Malith Jayathissa + 1 · Published 2018-09-26 · Updated 2019-10-03 · CVE-2018-14327

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Alcatel OSPREY3 MINI Modem component on EE EE40VB 4G mobile broadband modems with firmware prior to EE40 00 02.00 45

Description The issue concerns weak permissions set by the installer for certain directories, allowing local users to gain privileges. This is demonstrated by the potential to insert a Trojan horse ServiceManager.exe file into the "Web ConnectonEE40BackgroundService" directory.

Recommendations For firmware versions prior to EE40 00 02.00 45, update the firmware to EE40 00 02.00 45 or later to resolve the issue.

Exploit

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2018-14327

Affected Products

Alcatel Osprey3 Mini

References · 7

• 🔥 https://exploit-db.com/exploits/45501 · Exploit
• 🔥 http://packetstormsecurity.com/files/149492/EE-4GEE-Mini-Local-Privilege-Escalation.html · Exploit
• 🔥 http://blog.zerodaylab.com/2018/09/zerodaylab-discovers-ee-unquoted.html · Exploit
• 🔥 https://osandamalith.com/2018/09/17/ee-4gee-mini-local-privilege-escalation-vulnerability-cve-2018-14327 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-14327 · Security Note
• https://osv.dev/vulnerability/CVE-2018-14327 · Vendor Advisory
• http://securityfocus.com/bid/105385 · Note