| शीर्षक | Tecno Tecno 4G Portable WiFi TR118 TR118-M30E-RR-D-EnFrArSwHaPo-OP-V008-20220830 Command Injection |
|---|
| विवरण | A vulnerability was found in Tecno 4G Portable WiFi TR118 firmware version(TR118-M30E-RR-D-EnFrArSwHaPo-OP-V008-20220830) that allows an authenticated remote attacker on LAN to execute arbitrary code via a crafted request using the ping feature of the network diagnostic tools. The vulnerability is a blind command injection that allows an attacker to execute arbitrary commands on the device due to client side validation being performed on the request and no server side validation being done. With tools such as BurpSuite, an attacker can intercept and alter the request to include system commands enclosed in backticks which are executed by the device.
** The vendor requested to only provide a rough description of the vulnerability details without mentioning specific product information. Kindly do not disclose the POC to the public**
|
|---|
| स्रोत | ⚠️ https://drive.google.com/file/d/1DUSlAxTbNLBdv1aLUAn-tDMu6Z1rHYH8/view?usp=drive_link |
|---|
| उपयोगकर्ता | Allan Njuguna (UID 57480) |
|---|
| सबमिशन | 16/11/2023 04:58 PM (3 साल पहले) |
|---|
| संयम | 26/11/2023 08:54 AM (10 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 246130 [Tecno 4G Portable WiFi TR118 TR118-M30E-RR-D-EnFrArSwHaPo-OP-V008-20220830 Ping Tool goform_get_cmd_process url अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|