PT-2023-2850 · Parks · Parks Fiberlink 210

Gabriel Schneider + 1 · Published 2023-05-23 · Updated 2023-05-30 · CVE-2023-33617

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Parks Fiberlink 210 firmware version V2.1.14 X000

Description An OS Command Injection issue exists due to the lack of neutralization of special elements used in the operating system command. This can be exploited via the "/boaform/admin/formPing" target addr parameter, allowing an attacker to execute arbitrary commands on the server. The target addr parameter is vulnerable to this issue.

Recommendations For Parks Fiberlink 210 firmware version V2.1.14 X000, as a temporary workaround, consider disabling the /boaform/admin/formPing endpoint until a patch is available. Restrict access to this endpoint to minimize the risk of exploitation. Avoid using the target addr parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2023-02795

CVE-2023-33617

Affected Products

Parks Fiberlink 210

References · 9

• 🔥 https://gist.github.com/gbrls/58a5032bc58510abb908386124d1b4d2 · Exploit
• https://osv.dev/vulnerability/CVE-2023-33617 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02795 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-33617 · Security Note
• https://t.me/defcon_news/114094 · Telegram Post
• https://t.me/rnetsec/18746 · Telegram Post
• https://t.me/secharvester/13811 · Telegram Post
• https://t.me/cvenotify/50986 · Telegram Post
• https://t.me/cibsecurity/64629 · Telegram Post