PT-2018-6585 · Openwrt+1 · Openwrt+2

Neonsea · Published 2018-01-04 · Updated 2019-10-03 · CVE-2017-17867

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Inteno iopsys versions 2.0 through 3.14 Inteno iopsys version 4.0

Description: The issue allows remote authenticated users to execute arbitrary OS commands by modifying the leasetrigger field in the odhcpd configuration. This can be done to specify an arbitrary program, such as one located on an SMB share. The problem exists due to the improper use of the /etc/uci-defaults directory, which fails to secure the OpenWrt configuration.

Recommendations: For Inteno iopsys versions 2.0 through 3.14, update the configuration to properly utilize the /etc/uci-defaults directory for securing OpenWrt. For Inteno iopsys version 4.0, update the configuration to properly utilize the /etc/uci-defaults directory for securing OpenWrt. As a temporary workaround, consider restricting access to the odhcpd configuration to minimize the risk of exploitation.

Exploit

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2017-17867

Affected Products

Inteno Iopsys

Openwrt

Odhcpd

References · 5

• 🔥 https://exploit-db.com/exploits/43428 · Exploit
• 🔥 https://neonsea.uk/blog/2017/12/23/rce-inteno-iopsys.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-17867 · Security Note
• https://osv.dev/vulnerability/CVE-2017-17867 · Vendor Advisory
• http://public.inteno.se/?p=feed-inteno-openwrt.git%3Ba=commit%3Bh=efcc985a721107e72a66da4db66891ec54441998 · Note