PT-2019-15393 · Technicolor · Td5130V2

Published 2019-10-31 · Updated 2020-02-10 · CVE-2019-18396

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Technicolor TD5130v2 devices with Oi third-party firmware OI Fw V20

Description A Command Injection issue in the Ping module of the Web Interface allows remote attackers to execute arbitrary OS commands. This is achieved by exploiting the pingAddr parameter in the "mnt ping.cgi" endpoint.

Recommendations For Technicolor TD5130v2 devices with Oi third-party firmware OI Fw V20, avoid using the pingAddr parameter in the "mnt ping.cgi" endpoint until a fix is available. As a temporary workaround, consider restricting access to the Ping module in the Web Interface to minimize the risk of exploitation.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2019-18396

Affected Products

Td5130V2

References · 8

• 🔥 https://medium.com/@c4pt41nnn/cve-2019-18396-command-injection-in-technicolor-router-da5dd2134052 · Exploit
• 🔥 https://exploit-db.com/exploits/47651 · Exploit
• 🔥 https://packetstormsecurity.com/files/155296/Technicolor-TD5130.2-Remote-Command-Execution.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-18396 · Security Note
• https://osv.dev/vulnerability/CVE-2019-18396 · Vendor Advisory
• https://medium.com/%40c4pt41nnn/cve-2019-18396-command-injection-in-technicolor-router-da5dd2134052 · Note
• http://packetstormsecurity.com/files/155296/Technicolor-TD5130.2-Remote-Command-Execution.html · Note
• https://twitter.com/c4pt41nnn · Note