An authenticated shell command injection issue has been discovered in Raisecom ISCOM HT803G-U, HT803G-W, HT803G-1GE, and HT803G GPON products with the firmware version ISCOMHT803G-U_2.0.0_140521_R4.1.47.002 or below, The values of the newpass and confpass parameters in /bin/WebMGR are used in a system call in the firmware. Because there is no user input validation, this leads to authenticated code execution on the device.
References
Configurations
Configuration 1 (hide)
| AND |
|
Configuration 2 (hide)
| AND |
|
Configuration 3 (hide)
| AND |
|
Configuration 4 (hide)
| AND |
|
History
21 Nov 2024, 04:48
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://breakthesec.com - Third Party Advisory | |
| References | () http://packetstormsecurity.com/files/151650/Raisecom-Technology-GPON-ONU-HT803G-07-Command-Injection.html - Exploit, Third Party Advisory, VDB Entry | |
| References | () http://seclists.org/fulldisclosure/2019/Feb/34 - Exploit, Mailing List, Third Party Advisory | |
| References | () http://www.breakthesec.com/search/label/0day - Exploit, Third Party Advisory | |
| References | () http://www.securityfocus.com/bid/107030 - Third Party Advisory, VDB Entry | |
| References | () https://s3curityb3ast.github.io - Third Party Advisory | |
| References | () https://s3curityb3ast.github.io/KSA-Dev-006.md - Third Party Advisory |
Information
Published : 2019-03-21 16:01
Updated : 2024-11-21 04:48
NVD link : CVE-2019-7385
Mitre link : CVE-2019-7385
CVE.ORG link : CVE-2019-7385
JSON object : View
Products Affected
raisecom
- iscom_ht803g-u
- iscom_ht803g-1ge_firmware
- iscom_ht803g_gpon_firmware
- iscom_ht803g-w
- iscom_ht803g-u_firmware
- iscom_ht803g_gpon
- iscom_ht803g-w_firmware
- iscom_ht803g-1ge
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')