PT-2019-18381 · Rdk · Ccspwifiagent

Published 2019-06-20 · Updated 2020-08-24 · CVE-2019-6962

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions RDK RDKB-20181217-1 CcspWifiAgent module (affected versions not specified)

Description A shell injection issue in the CcspWifiAgent module allows attackers with login credentials to execute arbitrary shell commands under the CcspWifiSsp process, which runs as root. This issue is related to the WebUI module and can be exploited by changing the Wi-Fi network password to include crafted escape characters, but only if the platform was compiled with the ENABLE FEATURE MESHWIFI macro.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2019-6962

Affected Products

Ccspwifiagent

References · 3

• https://osv.dev/vulnerability/CVE-2019-6962 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-6962 · Security Note
• https://dojo.bullguard.com/dojo-by-bullguard/blog/the-gateway-is-wide-open · Note