PT-2023-32604 · Tecno · Tecno 4G Portable Wifi Tr118

Allan Njuguna · Published 2023-11-27 · Updated 2024-05-17 · CVE-2023-6304

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:N/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Tecno 4G Portable WiFi TR118 version TR118-M30E-RR-D-EnFrArSwHaPo-OP-V008-20220830

Description A critical issue has been identified, affecting the Ping Tool component, specifically the /goform/goform get cmd process file. The url argument is vulnerable to os command injection, which can be exploited remotely. The issue has been publicly disclosed.

Recommendations For version TR118-M30E-RR-D-EnFrArSwHaPo-OP-V008-20220830, as a temporary workaround, consider restricting access to the Ping Tool component, specifically the /goform/goform get cmd process file, to minimize the risk of exploitation. Avoid using the url argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2023-6304

Affected Products

Tecno 4G Portable Wifi Tr118

References · 6

• 🔥 https://drive.google.com/file/d/1DUSlAxTbNLBdv1aLUAn-tDMu6Z1rHYH8/view · Exploit
• https://osv.dev/vulnerability/CVE-2023-6304 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6304 · Security Note
• https://vuldb.com/?id.246130 · Note
• https://vuldb.com/?ctiid.246130 · Note
• https://t.me/pentestingnews/41431 · Telegram Post