| tiêu đề | Tecno Tecno 4G Portable WiFi TR118 TR118-M30E-RR-D-EnFrArSwHaPo-OP-V008-20220830 Command Injection |
|---|
| Mô tả | A vulnerability was found in Tecno 4G Portable WiFi TR118 firmware version(TR118-M30E-RR-D-EnFrArSwHaPo-OP-V008-20220830) that allows an authenticated remote attacker on LAN to execute arbitrary code via a crafted request using the ping feature of the network diagnostic tools. The vulnerability is a blind command injection that allows an attacker to execute arbitrary commands on the device due to client side validation being performed on the request and no server side validation being done. With tools such as BurpSuite, an attacker can intercept and alter the request to include system commands enclosed in backticks which are executed by the device.
** The vendor requested to only provide a rough description of the vulnerability details without mentioning specific product information. Kindly do not disclose the POC to the public**
|
|---|
| Nguồn | ⚠️ https://drive.google.com/file/d/1DUSlAxTbNLBdv1aLUAn-tDMu6Z1rHYH8/view?usp=drive_link |
|---|
| Người dùng | Allan Njuguna (UID 57480) |
|---|
| Đệ trình | 16/11/2023 16:58 (cách đây 3 những năm) |
|---|
| Kiểm duyệt | 26/11/2023 08:54 (10 days later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 246130 [Tecno 4G Portable WiFi TR118 TR118-M30E-RR-D-EnFrArSwHaPo-OP-V008-20220830 Ping Tool goform_get_cmd_process url nâng cao đặc quyền] |
|---|
| điểm | 20 |
|---|