CVE-2013-5948

The Network Analysis tab (Main_Analysis_Content.asp) in the ASUS RT-AC68U and other RT series routers with firmware before 3.0.0.4.374.5047 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the Target field (destIP parameter).

CVSS v2.0 8.5 HIGH

8.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:S/C:C/I:C/A:C

Exploitability : 6.8 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://seclists.org/fulldisclosure/2014/Apr/59
http://seclists.org/fulldisclosure/2014/Apr/66	Exploit
http://support.asus.com/download.aspx?m=RT-N66U+%28VER.B1%29
https://support.t-mobile.com/docs/DOC-21994
http://seclists.org/fulldisclosure/2014/Apr/59
http://seclists.org/fulldisclosure/2014/Apr/66	Exploit
http://support.asus.com/download.aspx?m=RT-N66U+%28VER.B1%29
https://support.t-mobile.com/docs/DOC-21994

Configurations

Configuration 1 (hide)

cpe:2.3:o:t-mobile:tm-ac1900:3.0.0.4.376_3169:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

OR	cpe:2.3:o:asus:rt-ac68u_firmware:3.0.0.4.374.4755:::::::*
	cpe:2.3:o:asus:rt-ac68u_firmware:3.0.0.4.374_4561:::::::*
	cpe:2.3:o:asus:rt-ac68u_firmware:3.0.0.4.374_4887:::::::*

cpe:2.3:h:asus:rt-ac68u:-:*:*:*:*:*:*:*

History

21 Nov 2024, 01:58

Type	Values Removed	Values Added
References	~~() http://seclists.org/fulldisclosure/2014/Apr/59 -~~	() http://seclists.org/fulldisclosure/2014/Apr/59 -
References	~~() http://seclists.org/fulldisclosure/2014/Apr/66 - Exploit~~	() http://seclists.org/fulldisclosure/2014/Apr/66 - Exploit
References	~~() http://support.asus.com/download.aspx?m=RT-N66U+%28VER.B1%29 -~~	() http://support.asus.com/download.aspx?m=RT-N66U+%28VER.B1%29 -
References	~~() https://support.t-mobile.com/docs/DOC-21994 -~~	() https://support.t-mobile.com/docs/DOC-21994 -

Information

Published : 2014-04-22 13:06

Updated : 2024-11-21 01:58

NVD link : CVE-2013-5948

Mitre link : CVE-2013-5948

CVE.ORG link : CVE-2013-5948

JSON object : View

Products Affected

asus

rt-ac68u
rt-ac68u_firmware

t-mobile

tm-ac1900

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2013-5948", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 8.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-04-22T13:06:25.070", "references": [{"url": "http://seclists.org/fulldisclosure/2014/Apr/59", "source": "cve@mitre.org"}, {"url": "http://seclists.org/fulldisclosure/2014/Apr/66", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://support.asus.com/download.aspx?m=RT-N66U+%28VER.B1%29", "source": "cve@mitre.org"}, {"url": "https://support.t-mobile.com/docs/DOC-21994", "source": "cve@mitre.org"}, {"url": "http://seclists.org/fulldisclosure/2014/Apr/59", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://seclists.org/fulldisclosure/2014/Apr/66", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://support.asus.com/download.aspx?m=RT-N66U+%28VER.B1%29", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://support.t-mobile.com/docs/DOC-21994", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "The Network Analysis tab (Main_Analysis_Content.asp) in the ASUS RT-AC68U and other RT series routers with firmware before 3.0.0.4.374.5047 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the Target field (destIP parameter)."}, {"lang": "es", "value": "La etiqueta Network Analysis (Main_Analysis_Content.asp) en los routers ASUS RT-AC68U y otros series RT con firmware anterior a 3.0.0.4.374.5047 permite a usuarios remotos autenticados ejecutar comandos arbitrarios a trav\u00e9s de metacaracteres de shell en el campo Target ( par\u00e1metro destIP)."}], "lastModified": "2024-11-21T01:58:28.540", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:t-mobile:tm-ac1900:3.0.0.4.376_3169:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "919D9673-1FCA-431D-9F30-643AAEFAC1DA"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:asus:rt-ac68u_firmware:3.0.0.4.374.4755:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "536FCD9A-4DBA-465D-8FE8-9E9D815BAB81"}, {"criteria": "cpe:2.3:o:asus:rt-ac68u_firmware:3.0.0.4.374_4561:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6E3E3F39-1F5A-4AE5-A379-3344BFC1E00D"}, {"criteria": "cpe:2.3:o:asus:rt-ac68u_firmware:3.0.0.4.374_4887:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "753D3C81-F078-47B9-8D0B-822EBE9443AE"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:asus:rt-ac68u:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1E23D00B-76E3-438C-8023-3D7CC6AEEE15"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}