PT-2019-16064 · Alcatel Lucent · Alcatel-Lucent Omnivista 4760

0X1911 · Published 2019-12-27 · Updated 2020-01-07 · CVE-2019-20049

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Alcatel-Lucent OmniVista 4760 (affected versions not specified)

Description A remote unauthenticated attacker can exploit a combination of directory traversal and insecure file upload vulnerabilities to achieve Remote Code Execution as SYSTEM. The directory traversal vulnerability is located in the construct() function, while the insecure file upload vulnerability is found in the SetSkinImages() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2019-20049

Affected Products

Alcatel-Lucent Omnivista 4760

References · 5

• 🔥 https://packetstormsecurity.com/files/155595/Alcatel-Lucent-Omnivista-8770-Remote-Code-Execution.html · Exploit
• 🔥 https://git.lsd.cat/g/omnivista-rce · Exploit
• 🔥 https://exploit-db.com/exploits/47761 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-20049 · Security Note
• https://al-enterprise.com/en/-/media/assets/internet/documents/sa-c0065-ov8770-rce-vulnerability-en.pdf · Vendor Advisory