PT-2023-10704 · Abus · Tvip20050+7

A2Nkf + 5 · Published 2023-10-26 · Updated 2024-09-11 · CVE-2018-17558

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ABUS TVIP TVIP20050 version LM.1.6.18 ABUS TVIP TVIP10051 version LM.1.6.18 ABUS TVIP TVIP11050 version MG.1.6.03.05 ABUS TVIP TVIP20550 version LM.1.6.18 ABUS TVIP TVIP10050 version LM.1.6.18 ABUS TVIP TVIP11550 version MG.1.6.03 ABUS TVIP TVIP21050 version MG.1.6.03 ABUS TVIP TVIP51550 version MG.1.6.03

Description Hardcoded manufacturer credentials and an OS command injection vulnerability in the "/cgi-bin/mft/" directory allow remote attackers to execute code as root.

Recommendations For ABUS TVIP TVIP20050 version LM.1.6.18, consider disabling access to the "/cgi-bin/mft/" directory until a patch is available. For ABUS TVIP TVIP10051 version LM.1.6.18, consider disabling access to the "/cgi-bin/mft/" directory until a patch is available. For ABUS TVIP TVIP11050 version MG.1.6.03.05, consider disabling access to the "/cgi-bin/mft/" directory until a patch is available. For ABUS TVIP TVIP20550 version LM.1.6.18, consider disabling access to the "/cgi-bin/mft/" directory until a patch is available. For ABUS TVIP TVIP10050 version LM.1.6.18, consider disabling access to the "/cgi-bin/mft/" directory until a patch is available. For ABUS TVIP TVIP11550 version MG.1.6.03, consider disabling access to the "/cgi-bin/mft/" directory until a patch is available. For ABUS TVIP TVIP21050 version MG.1.6.03, consider disabling access to the "/cgi-bin/mft/" directory until a patch is available. For ABUS TVIP TVIP51550 version MG.1.6.03, consider disabling access to the "/cgi-bin/mft/" directory until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Using Hardcoded Credentials

Weakness Enumeration

CWE-78

CWE-798

Related Identifiers

CVE-2018-17558

Affected Products

Tvip10050

Tvip10051

Tvip11050

Tvip11550

Tvip20050

Tvip20550

Tvip21050

Tvip51550

References · 7

• 🔥 https://sec.maride.cc/posts/abus · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-17558 · Security Note
• https://ccc.de/en/updates/2019/update-nicht-verfugbar-hersteller-nicht-zu-erreichen · Note
• https://t.me/cvenotify/60065 · Telegram Post
• https://t.me/cvenotify/94263 · Telegram Post
• https://t.me/cibsecurity/73025 · Telegram Post
• https://twitter.com/CVEnew/status/1717653727329530092 · Twitter Post