CVE-2019-7385

An authenticated shell command injection issue has been discovered in Raisecom ISCOM HT803G-U, HT803G-W, HT803G-1GE, and HT803G GPON products with the firmware version ISCOMHT803G-U_2.0.0_140521_R4.1.47.002 or below, The values of the newpass and confpass parameters in /bin/WebMGR are used in a system call in the firmware. Because there is no user input validation, this leads to authenticated code execution on the device.
References
Link Resource
http://breakthesec.com Third Party Advisory
http://packetstormsecurity.com/files/151650/Raisecom-Technology-GPON-ONU-HT803G-07-Command-Injection.html Exploit Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2019/Feb/34 Exploit Third Party Advisory Mailing List
http://www.breakthesec.com/search/label/0day Exploit Third Party Advisory
http://www.securityfocus.com/bid/107030 Third Party Advisory VDB Entry
https://s3curityb3ast.github.io Third Party Advisory
https://s3curityb3ast.github.io/KSA-Dev-006.md Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:raisecom:iscom_ht803g-u_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:raisecom:iscom_ht803g-u:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:raisecom:iscom_ht803g-w_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:raisecom:iscom_ht803g-w:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:raisecom:iscom_ht803g-1ge_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:raisecom:iscom_ht803g-1ge:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:raisecom:iscom_ht803g_gpon_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:raisecom:iscom_ht803g_gpon:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-03-21 16:01

Updated : 2024-02-28 17:08


NVD link : CVE-2019-7385

Mitre link : CVE-2019-7385

CVE.ORG link : CVE-2019-7385


JSON object : View

Products Affected

raisecom

  • iscom_ht803g_gpon
  • iscom_ht803g-1ge_firmware
  • iscom_ht803g-u
  • iscom_ht803g_gpon_firmware
  • iscom_ht803g-1ge
  • iscom_ht803g-w_firmware
  • iscom_ht803g-w
  • iscom_ht803g-u_firmware
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')