PT-2021-15414 · Mercusys · Mercusys Mercury X18G

Published 2021-01-07 · Updated 2021-01-12 · CVE-2021-23242

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions MERCUSYS Mercury X18G version 1.0.5

Description The issue allows Directory Traversal via ../ to the UPnP server. An example of this is demonstrated by the "/../../conf/template/uhttpd.json" URI, which showcases the vulnerability.

Recommendations For MERCUSYS Mercury X18G version 1.0.5, consider restricting access to the UPnP server to minimize the risk of exploitation. As a temporary workaround, avoid using the ../ sequence in URI requests to the UPnP server until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-23242

Affected Products

Mercusys Mercury X18G

References · 7

• 🔥❌ https://github.com/BATTZION/MY_REQUEST/blob/master/Mercury%20Router%20Upnp%20Server%20Directory%20Traversal.md · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2021-23242 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23242 · Security Note
• https://mercurycom.com.cn/product-521-1.html · Vendor Advisory
• https://mercusys.com/en · Vendor Advisory
• https://t.me/cvenotify/8295 · Telegram Post
• https://t.me/cibsecurity/21792 · Telegram Post