PT-2019-16602 · Wifi Soft · Wifi-Soft Unibox Controller

Sahil Dhar · Published 2019-03-18 · Updated 2021-09-13 · CVE-2019-3497

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Wifi-soft UniBox controller versions 0.x through 2.x

Description An issue in the Diagnostic Tools component of the Wifi-soft UniBox controller allows for Remote Command Execution. This is due to the tools/ping Ping feature being vulnerable, enabling an attacker to execute arbitrary system commands on the server with root user privileges. The authentication for accessing this component can be bypassed by utilizing hard-coded credentials.

Recommendations For Wifi-soft UniBox controller versions 0.x through 2.x, consider disabling the tools/ping Ping feature in the Diagnostic Tools component until a patch is available to prevent Remote Command Execution. Restrict access to the Diagnostic Tools component to minimize the risk of exploitation. Avoid using hard-coded credentials for authentication.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2019-3497

Affected Products

Wifi-Soft Unibox Controller

References · 4

• 🔥 http://packetstormsecurity.com/files/151077/Wifi-soft-Unibox-2.x-Remote-Command-Code-Injection.html · Exploit
• 🔥 https://sahildhar.github.io/blogpost/Multiple-RCE-Vulnerabilties-in-Unibox-Controller-0.x-3.x · Exploit
• 🔥 http://seclists.org/fulldisclosure/2019/Jan/23 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-3497 · Security Note