PT-2020-9788 · Netsas · Netsas Enigma Nms

Published 2020-03-19 · Updated 2020-03-24 · CVE-2019-16072

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions NETSAS Enigma NMS versions 65.0.0 and prior

Description An OS command injection issue in the discover and manage CGI script allows an attacker to execute arbitrary code due to improper neutralization of shell metacharacters in the ip address variable within an snmp browser action.

Recommendations For versions 65.0.0 and prior, consider restricting access to the discover and manage CGI script until a patch is available. As a temporary workaround, avoid using the ip address variable in the snmp browser action to minimize the risk of exploitation.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2019-16072

Affected Products

Netsas Enigma Nms

References · 6

• 🔥 https://packetstormsecurity.com/files/155296/Technicolor-TD5130.2-Remote-Command-Execution.html · Exploit
• 🔥 https://exploit-db.com/exploits/47364 · Exploit
• 🔥 https://mogozobo.com/?p=3647 · Exploit
• https://osv.dev/vulnerability/CVE-2019-16072 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16072 · Security Note
• https://t.me/cvenotify/1922 · Telegram Post