CVE-2019-3495

An issue was discovered on Wifi-soft UniBox controller 0.x through 2.x devices. network/mesh/edit-nds.php is vulnerable to arbitrary file upload, allowing an attacker to upload .php files and execute code on the server with root user privileges. Authentication for accessing this component can be bypassed by using Hard coded credentials.
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:indionetworks:unibox_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:indionetworks:unibox:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-03-21 16:01

Updated : 2024-02-28 17:08


NVD link : CVE-2019-3495

Mitre link : CVE-2019-3495

CVE.ORG link : CVE-2019-3495


JSON object : View

Products Affected

indionetworks

  • unibox_firmware
  • unibox
CWE
CWE-434

Unrestricted Upload of File with Dangerous Type

CWE-798

Use of Hard-coded Credentials