PT-2021-16802 · China Mobile · An Lianbao Wf-1

Published 2021-04-29 · Updated 2021-05-07 · CVE-2021-25812

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions China Mobile An Lianbao WF-1 version 1.01

Description A command injection issue exists, allowing for potential exploitation via the ip parameter in a POST request to the "/api/ZRQos/set online client" API endpoint.

Recommendations For version 1.01, avoid using the ip parameter in the "/api/ZRQos/set online client" API endpoint until the issue is resolved. As a temporary workaround, consider restricting access to this endpoint to minimize the risk of exploitation.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2021-25812

Affected Products

An Lianbao Wf-1

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-25812 · Security Note
• https://osv.dev/vulnerability/CVE-2021-25812 · Vendor Advisory
• ❌ https://github.com/pokerfacett/MY_REQUEST/blob/master/China%20Mobile%20An%20Lianbao%20WF-1%20router%20Command%20Injection.md · Note, Deleted
• http://iot.10086.cn/?l=en-us · Note
• https://zhipinmall.com/prodetail?id=1266#skuId=3020 · Note