PT-2019-10078 · Inteno · Inteno Iopsys

Rasmus Moorats · Published 2019-04-11 · Updated 2019-04-12 · CVE-2018-20487

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Inteno IOPSYS versions 1.0 through 3.16

Description: An issue was discovered in the firewall3 component. The attacker must make a JSON-RPC method call to add a firewall rule as an "include" and point the path argument to a malicious script or binary. This gets executed as root when the firewall changes are committed.

Recommendations: For Inteno IOPSYS versions 1.0 through 3.16, consider restricting access to the JSON-RPC method to add firewall rules until a patch is available. As a temporary workaround, avoid using the path argument to point to external scripts or binaries.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-20487

Affected Products

Inteno Iopsys

References · 4

• 🔥 https://neonsea.uk/blog/2018/12/26/firewall-includes.html · Exploit
• https://osv.dev/vulnerability/CVE-2018-20487 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-20487 · Security Note
• http://public.inteno.se/?p=feed-inteno-openwrt.git%3Ba=commit%3Bh=e6159ca928d7f0c143be213afc6bf810c0329fe2 · Note