PT-2023-25031 · Ikuai · Ikuai Router Os

Published 2023-06-29 · Updated 2023-07-06 · CVE-2023-34849

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ikuai router OS versions through 3.7.1

Description An unauthorized command injection vulnerability exists in the ActionLogin function of the webman.lua file. This issue allows for command injection, potentially leading to unauthorized access or control.

Recommendations For Ikuai router OS versions through 3.7.1, as a temporary workaround, consider disabling the ActionLogin function until a patch is available. Restrict access to the webman.lua file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2023-34849

Affected Products

Ikuai Router Os

References · 5

• 🔥 https://github.com/cczzmm/IOT-POC/tree/main/Ikuai · Exploit
• https://osv.dev/vulnerability/CVE-2023-34849 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-34849 · Security Note
• https://t.me/cibsecurity/65718 · Telegram Post
• https://t.me/cvenotify/53304 · Telegram Post