PT-2019-14235 · Openwrt · Libuci+1

Published 2019-08-23 · Updated 2021-01-03 · CVE-2019-15513

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions OpenWrt libuci versions prior to 15.05.1

Description An issue was discovered in OpenWrt libuci, where /tmp/.uci/network locking is mishandled after reception of a long SetWanSettings command, leading to a device hang.

Recommendations For versions prior to 15.05.1, update to version 15.05.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the SetWanSettings command to minimize the risk of exploitation.

Exploit

Fix

Improper Locking

Weakness Enumeration

CWE-667

Related Identifiers

CVE-2019-15513

Affected Products

Openwrt

Libuci

References · 7

• 🔥 https://github.com/TeamSeri0us/pocs/blob/master/iot/morouter/motorola%E8%B7%AF%E7%94%B1%E5%99%A8%E6%96%87%E4%BB%B6%E8%A7%A3%E9%94%81%E6%BC%8F%E6%B4%9E.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2019-15513 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15513 · Security Note
• https://lists.openwrt.org/pipermail/openwrt-devel/2019-November/025453.html · Note
• https://t.me/cvenotify/8111 · Telegram Post
• https://git.openwrt.org/?p=project/uci.git%3Ba=commitdiff%3Bh=19e29ffc15dbd958e8e6a648ee0982c68353516f · Note
• https://lists.infradead.org/pipermail/openwrt-devel/2019-November/019736.html · Note