CVE-2019-18396

{"id": "CVE-2019-18396", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2019-10-31T20:15:11.163", "references": [{"url": "http://packetstormsecurity.com/files/155296/Technicolor-TD5130.2-Remote-Command-Execution.html", "source": "cve@mitre.org"}, {"url": "https://medium.com/%40c4pt41nnn/cve-2019-18396-command-injection-in-technicolor-router-da5dd2134052", "source": "cve@mitre.org"}, {"url": "https://www.twitter.com/c4pt41nnn", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://packetstormsecurity.com/files/155296/Technicolor-TD5130.2-Remote-Command-Execution.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://medium.com/%40c4pt41nnn/cve-2019-18396-command-injection-in-technicolor-router-da5dd2134052", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.twitter.com/c4pt41nnn", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in certain Oi third-party firmware that may be installed on Technicolor TD5130v2 devices. A Command Injection in the Ping module in the Web Interface in OI_Fw_V20 allows remote attackers to execute arbitrary OS commands in the pingAddr parameter to mnt_ping.cgi. NOTE: This may overlap CVE-2017\u201314127."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en cierto firmware de terceros Oi que se puede instalar en dispositivos Technicolor TD5130v2. Una inyecci\u00f3n de comandos en el m\u00f3dulo Ping en la interfaz web en OI_Fw_V20 permite a los atacantes remotos ejecutar comandos arbitrarios del sistema operativo en el par\u00e1metro pingAddr a mnt_ping.cgi. NOTA: Esto puede superponerse a CVE-2017\u201314127."}], "lastModified": "2024-11-21T04:33:11.903", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:technicolor:td5130v2_firmware:oi_fw_v20:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DC3DDFB2-D647-49D6-82A7-B4C3D01F0BE3"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:technicolor:td5130v2:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "153E8D9D-3B2E-4143-A01F-C838A5F58589"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}