| عنوان | China Mobile Internet of Things Enterprise Gateway GT3200-8G8P;GT3200-4G4P;ZXWT-MIG-P8G8V;ZXWT-MIG-P4G4V;P22g-CIac Execution of unauthorized command |
|---|
| الوصف | Among the affected enterprise gateway devices, attackers can enable the **Telnet service on the LAN side** without authorization. Moreover, if attackers log in to the devices using the default weak passwords, they can also utilize an **effective Token** to enable the **Telnet service on the WAN side**. Due to the existence of **hard-coded credentials** for the Telnet service's authentication, attackers can escalate their privileges to root by using the **su command** after connecting to Telnet (the default password for the Telnet account is the default one), and the root password is also hard-coded. This vulnerability enables attackers to fully control the affected gateway devices, thereby endangering the overall network security. |
|---|
| المصدر | ⚠️ https://github.com/Fizz-L/Vulnerability-report/blob/main/Unauthorized%20access%20to%20execute%20the%20telnet%20command.md |
|---|
| المستخدم | FizzL (UID 82411) |
|---|
| ارسال | 05/03/2025 01:50 PM (1 سنة منذ) |
|---|
| الاعتدال | 17/03/2025 08:01 AM (12 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 299896 [China Mobile P22g-CIac حتى 20250305 Telnet Service تجاوز الصلاحيات] |
|---|
| النقاط | 20 |
|---|