CVE-2020-25859

The QCMAP_CLI utility in the Qualcomm QCMAP software suite prior to versions released in October 2020 uses a system() call without validating the input, while handling a SetGatewayUrl() request. A local attacker with shell access can pass shell metacharacters and run arbitrary commands. If QCMAP_CLI can be run via sudo or setuid, this also allows elevating privileges to root. This version of QCMAP is used in many kinds of networking devices, primarily mobile hotspots and LTE routers.

CVSS v3 6.7 MEDIUM
CVSS v2.0 7.2 HIGH

6.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://vdoo.com/blog/qualcomm-qcmap-vulnerabilities	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:qualcomm:qcmap:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-10-15 16:15

Updated : 2024-02-28 18:08

NVD link : CVE-2020-25859

Mitre link : CVE-2020-25859

CVE.ORG link : CVE-2020-25859

JSON object : View

Products Affected

qualcomm

qcmap

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2020-25859", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.8}]}, "published": "2020-10-15T16:15:12.180", "references": [{"url": "http://vdoo.com/blog/qualcomm-qcmap-vulnerabilities", "tags": ["Exploit", "Third Party Advisory"], "source": "vuln@vdoo.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}, {"type": "Secondary", "source": "vuln@vdoo.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "The QCMAP_CLI utility in the Qualcomm QCMAP software suite prior to versions released in October 2020 uses a system() call without validating the input, while handling a SetGatewayUrl() request. A local attacker with shell access can pass shell metacharacters and run arbitrary commands. If QCMAP_CLI can be run via sudo or setuid, this also allows elevating privileges to root. This version of QCMAP is used in many kinds of networking devices, primarily mobile hotspots and LTE routers."}, {"lang": "es", "value": "La utilidad QCMAP_CLI en la suite de software Qualcomm QCMAP anteriores a las versiones publicadas en octubre de 2020 usa una llamada system() sin comprobar la entrada, mientras maneja una petici\u00f3n de SetGatewayUrl(). Un atacante local con acceso de shell puede pasar metacaracteres de shell y ejecutar comandos arbitrarios. Si QCMAP_CLI puede ser ejecutado por medio de sudo o setuid, esto tambi\u00e9n permite elevar privilegios a root. Esta versi\u00f3n de QCMAP es usada en muchos tipos de dispositivos de red, principalmente puntos de acceso m\u00f3viles y enrutadores LTE"}], "lastModified": "2020-10-28T15:15:25.427", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:qualcomm:qcmap:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "75258FE5-0296-4024-B968-A00E6917E174"}], "operator": "OR"}]}], "sourceIdentifier": "vuln@vdoo.com"}