PT-2022-11594 · Sapido · Sapido Br270N+3

Ireading · Published 2022-11-30 · Updated 2022-12-02 · CVE-2021-4242

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sapido BR270n (affected versions not specified) Sapido BRC76n (affected versions not specified) Sapido GR297 (affected versions not specified) Sapido RB1732 (affected versions not specified)

Description A critical issue affects some unknown functionality of the file ip/syscmd.htm, leading to os command injection. The attack can be launched remotely.

Recommendations For Sapido BR270n, consider restricting access to the file ip/syscmd.htm to minimize the risk of exploitation. For Sapido BRC76n, consider restricting access to the file ip/syscmd.htm to minimize the risk of exploitation. For Sapido GR297, consider restricting access to the file ip/syscmd.htm to minimize the risk of exploitation. For Sapido RB1732, consider restricting access to the file ip/syscmd.htm to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Neutralization

OS Command Injection

Weakness Enumeration

CWE-707

CWE-78

Related Identifiers

CVE-2021-4242

Affected Products

Sapido Br270N

Sapido Brc76N

Sapido Gr297N

Sapido Rb1732

References · 6

• 🔥 https://github.com/smallpiggy/Sapido--rce/blob/main/Sapido%E8%B7%AF%E7%94%B1%E5%99%A8-rce.py · Exploit
• 🔥 https://blog.csdn.net/qq_44159028/article/details/114590267 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-4242 · Security Note
• https://osv.dev/vulnerability/CVE-2021-4242 · Vendor Advisory
• https://t.me/cibsecurity/53723 · Telegram Post
• https://vuldb.com/?id.214592 · Note