PT-2018-13042 · Mystrom · Mystrom Wifi Switch Eu

Almeroth + 1 · Published 2018-08-30 · Updated 2018-11-09 · CVE-2018-15477

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions myStrom WiFi Switch V1 versions prior to 2.66

Description The issue concerns a lack of sanitization for a parameter received from the cloud, which is then used in an OS command. This allows malicious servers to execute operating system commands on the device.

Recommendations For versions prior to 2.66, update to version 2.66 or later to resolve the issue.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2018-15477

Affected Products

Mystrom Wifi Switch Eu

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-15477 · Security Note
• https://osv.dev/vulnerability/CVE-2018-15477 · Vendor Advisory
• https://swisscom.ch/content/dam/swisscom/de/about/nachhaltigkeit/digitale-schweiz/sicherheit/bug-bounty/files/cve-2018-15476ff.txt · Note