PT-2019-10273 · Hootoo · Hootoo Tripmate Titan

Published 2019-06-11 · Updated 2019-06-12 · CVE-2018-20841

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: HooToo TripMate Titan HT-TM05 and HT-05 routers with firmware 2.000.022 and 2.000.082

Description: The issue allows remote command execution via shell metacharacters in the mac parameter of a "protocol.csp?function=set&fname=security&opt=mac table" request.

Recommendations: For firmware 2.000.022, avoid using the mac parameter in the affected API endpoint until the issue is resolved. For firmware 2.000.082, restrict access to the vulnerable protocol.csp endpoint to minimize the risk of exploitation.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2018-20841

Affected Products

Hootoo Tripmate Titan

References · 4

• 🔥 https://exploit-db.com/exploits/46143 · Exploit
• 🔥 https://ioactive.com/hootoo-tripmate-routers-are-cute-but · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-20841 · Security Note
• https://osv.dev/vulnerability/CVE-2018-20841 · Vendor Advisory