| عنوان | Tecno Tecno 4G Portable WiFi TR118 TR118-M30E-RR-D-EnFrArSwHaPo-OP-V008-20220830 Command Injection |
|---|
| الوصف | A vulnerability was found in Tecno 4G Portable WiFi TR118 firmware version(TR118-M30E-RR-D-EnFrArSwHaPo-OP-V008-20220830) that allows an authenticated remote attacker on LAN to execute arbitrary code via a crafted request using the ping feature of the network diagnostic tools. The vulnerability is a blind command injection that allows an attacker to execute arbitrary commands on the device due to client side validation being performed on the request and no server side validation being done. With tools such as BurpSuite, an attacker can intercept and alter the request to include system commands enclosed in backticks which are executed by the device.
** The vendor requested to only provide a rough description of the vulnerability details without mentioning specific product information. Kindly do not disclose the POC to the public**
|
|---|
| المصدر | ⚠️ https://drive.google.com/file/d/1DUSlAxTbNLBdv1aLUAn-tDMu6Z1rHYH8/view?usp=drive_link |
|---|
| المستخدم | Allan Njuguna (UID 57480) |
|---|
| ارسال | 16/11/2023 04:58 PM (3 سنوات منذ) |
|---|
| الاعتدال | 26/11/2023 08:54 AM (10 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 246130 [Tecno 4G Portable WiFi TR118 TR118-M30E-RR-D-EnFrArSwHaPo-OP-V008-20220830 Ping Tool goform_get_cmd_process url تجاوز الصلاحيات] |
|---|
| النقاط | 20 |
|---|