CVE-2019-3495

An issue was discovered on Wifi-soft UniBox controller 0.x through 2.x devices. network/mesh/edit-nds.php is vulnerable to arbitrary file upload, allowing an attacker to upload .php files and execute code on the server with root user privileges. Authentication for accessing this component can be bypassed by using Hard coded credentials.
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:indionetworks:unibox_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:indionetworks:unibox:-:*:*:*:*:*:*:*

History

21 Nov 2024, 04:42

Type Values Removed Values Added
References () http://packetstormsecurity.com/files/151077/Wifi-soft-Unibox-2.x-Remote-Command-Code-Injection.html - Exploit, Third Party Advisory, VDB Entry () http://packetstormsecurity.com/files/151077/Wifi-soft-Unibox-2.x-Remote-Command-Code-Injection.html - Exploit, Third Party Advisory, VDB Entry
References () http://seclists.org/fulldisclosure/2019/Jan/23 - Exploit, Mailing List, Third Party Advisory () http://seclists.org/fulldisclosure/2019/Jan/23 - Exploit, Mailing List, Third Party Advisory
References () https://sahildhar.github.io/blogpost/Multiple-RCE-Vulnerabilties-in-Unibox-Controller-0.x-3.x/ - Exploit, Third Party Advisory () https://sahildhar.github.io/blogpost/Multiple-RCE-Vulnerabilties-in-Unibox-Controller-0.x-3.x/ - Exploit, Third Party Advisory

Information

Published : 2019-03-21 16:01

Updated : 2024-11-21 04:42


NVD link : CVE-2019-3495

Mitre link : CVE-2019-3495

CVE.ORG link : CVE-2019-3495


JSON object : View

Products Affected

indionetworks

  • unibox_firmware
  • unibox
CWE
CWE-434

Unrestricted Upload of File with Dangerous Type

CWE-798

Use of Hard-coded Credentials