CVE-2013-3365 in TEW-812DRU
Summary
TRENDnet TEW-812DRU router allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) wan network prefix to internet/ipv6.asp; (2) remote port to adm/management.asp; (3) pptp username, (4) pptp password, (5) ip, (6) gateway, (7) l2tp username, or (8) l2tp password to internet/wan.asp; (9) NtpDstStart, (10) NtpDstEnd, or (11) NtpDstOffset to adm/time.asp; or (12) device url to adm/management.asp. NOTE: vectors 9, 10, and 11 can be exploited by unauthenticated remote attackers by leveraging CVE-2013-3098.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Reservation
05/06/2013
Disclosure
02/04/2014
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 9806 | TRENDnet TEW-812DRU Input Sanitizer setNTP.cgi os command injection | 78 | Proof-of-Concept | Not defined | CVE-2013-3365 |