CVE-2018-12528

An issue was discovered on Intex N150 devices. The backup/restore option does not check the file extension uploaded for importing a configuration files backup, which can lead to corrupting the router firmware settings or even the uploading of malicious files. In order to exploit the vulnerability, an attacker can upload any malicious file and force reboot the router with it.

CVSS v3 8.1 HIGH
CVSS v2.0 7.5 HIGH

8.1^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:S/C:N/I:P/A:C

Exploitability : 8.0 / Impact : 7.8

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact COMPLETE

References

Link	Resource
http://securitywarrior9.blogspot.com/2018/06/malicious-file-upload-intex-router-n.html	Exploit Third Party Advisory
https://www.exploit-db.com/exploits/44933/	Exploit Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:intex:n150_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:intex:n150:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-07-02 16:29

Updated : 2024-02-28 16:25

NVD link : CVE-2018-12528

Mitre link : CVE-2018-12528

CVE.ORG link : CVE-2018-12528

JSON object : View

Products Affected

intex

n150_firmware
n150

CWE

CWE-434

Unrestricted Upload of File with Dangerous Type

{"id": "CVE-2018-12528", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:C", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 7.8, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "published": "2018-07-02T16:29:00.350", "references": [{"url": "http://securitywarrior9.blogspot.com/2018/06/malicious-file-upload-intex-router-n.html", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.exploit-db.com/exploits/44933/", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered on Intex N150 devices. The backup/restore option does not check the file extension uploaded for importing a configuration files backup, which can lead to corrupting the router firmware settings or even the uploading of malicious files. In order to exploit the vulnerability, an attacker can upload any malicious file and force reboot the router with it."}, {"lang": "es", "value": "Se ha descubierto un problema en dispositivos Intex N150. La opci\u00f3n backup/restore no comprueba la extensi\u00f3n del archivo subido para importar una copia de seguridad de los archivos de configuraci\u00f3n, lo que puede conducir a la corrupci\u00f3n de las opciones del firmware del router o incluso a la subida de archivos maliciosos. Para explotar esta vulnerabilidad, un atacante puede subir cualquier archivo malicioso y forzar el reinicio del router con el mismo."}], "lastModified": "2018-09-05T13:03:36.597", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:intex:n150_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3C9E0B27-929F-47AF-8F2D-9CFF0ECC5330"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:intex:n150:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "FEAEB945-28FB-4F05-9241-7F1F88764FCA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}