PT-2023-21365 · Seowon Intech · Seowonintech Swc 5100W Wimax Bootloader

Cyber Guy + 1 · Published 2023-04-12 · Updated 2025-02-08 · CVE-2023-27826

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SeowonIntech SWC 5100W WIMAX Bootloader version 1.18.19.0, HW version 0.0.7.0, and FW versions 1.11.0.1, 1.9.9.4

Description The issue allows attackers to take over the system with root privilege by abusing the doSystem() function, enabling OS Command Injection. This allows for the execution of arbitrary system commands, potentially leading to a full system compromise.

Recommendations For SeowonIntech SWC 5100W WIMAX Bootloader version 1.18.19.0, consider disabling the doSystem() function to prevent OS Command Injection until a patch is available. For HW version 0.0.7.0, restrict access to the system to minimize the risk of exploitation. For FW versions 1.11.0.1 and 1.9.9.4, avoid using the vulnerable doSystem() function in critical operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2023-27826

Affected Products

Seowonintech Swc 5100W Wimax Bootloader

References · 8

• 🔥 https://exploit-db.com/exploits/51311 · Exploit
• 🔥 https://pastebin.com/raw/buhVV7iL · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-27826 · Security Note
• https://osv.dev/vulnerability/CVE-2023-27826 · Vendor Advisory
• https://t.me/cvenotify/110489 · Telegram Post
• https://t.me/cibsecurity/61967 · Telegram Post
• https://t.me/cvenotify/48110 · Telegram Post
• https://usermanual.wiki/SEOWON-INTECH/SWC5100W · Note