NetModule Router Software prior 4.6.0.106/4.8.0.101 Web Administration Interface /admin/gnssAutoAlign.php cleanup device_id os command injection

Summaryinfo

A vulnerability was found in NetModule Router Software. It has been classified as critical. Affected is the function cleanup of the file /admin/gnssAutoAlign.php of the component Web Administration Interface. The manipulation of the argument device_id leads to os command injection. This vulnerability is listed as CVE-2023-46306. The attack must be carried out from within the local network. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in NetModule Router Software (Router Operating System). It has been rated as critical. This issue affects the function cleanup of the file /admin/gnssAutoAlign.php of the component Web Administration Interface. The manipulation of the argument device_id with an unknown input leads to a os command injection vulnerability. Using CWE to declare the problem leads to CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The web administration interface in NetModule Router Software (NRSW) 4.6 before 4.6.0.106 and 4.8 before 4.8.0.101 executes an OS command constructed with unsanitized user input: shell metacharacters in the /admin/gnssAutoAlign.php device_id parameter. This occurs because another thread can be started before the trap that triggers the cleanup function. A successful exploit could allow an authenticated user to execute arbitrary commands with elevated privileges. NOTE: this is different from CVE-2023-0861 and CVE-2023-0862, which were fixed in version 4.6.0.105.

The weakness was presented 10/23/2023. It is possible to read the advisory at pentest.blog. The identification of this vulnerability is CVE-2023-46306 since 10/22/2023. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1202 according to MITRE ATT&CK.

By approaching the search of inurl:admin/gnssAutoAlign.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 4.6.0.106 or 4.8.0.101 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2023-50528). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• NetModule

Name

• Router Software

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion