提交 #880057: Cobham SATCOM COBHAM VSAT7090 COBHAM VSAT7090 Command Injection

The Cobham VSAT7090 maritime satellite router provides a web management interface for remote configuration and maintenance. Analysis reveals that upon receiving relevant requests, the firmware program invokes specific functions to handle and respond to such requests. The figure below illustrates the processing logic of the c_set_reports_decode function.
This vulnerability is located in the c_set_reports_decode function, which is used to parse JSON-formatted configuration requests sent by users, and it calls either the sub_20508 or sub_20868 function for specific parsing. The detailed process is shown in the figure below.
In the sub_20508 function, once the user's input configuration info is successfully extracted—specifically the information corresponding to the 'sender' and 'recipients' JSON keys—the function calls _snprintf to concatenate these two configurations and store them in the v17 variable. After that, the value in v17 is concatenated again, this time along with the mail-report.sh script, which is used to set up the email's sender and recipients. The detailed process is shown in the figure below.
During the process of concatenating the commands mentioned above, sender and recipients are parameters passed in by the user, and the function doesn't perform any filtering on these two parameters. It directly concatenates them and hands them over to the system function to execute, which causes any additional commands injected from the frontend to also be executed.
https://uvxbywu62qm.feishu.cn/wiki/ERgywyUVfiUM2lkfVLwc1swknXg?from=from_copylink

• 来源: ⚠️ https://uvxbywu62qm.feishu.cn/wiki/ERgywyUVfiUM2lkfVLwc1swknXg?from=from_copylink
• 用户: huliangjia (UID 99519)
• 提交: 2026-07-04 12時07分 (3 月前)
• 管理: 2026-09-01 01時01分 (2 months later)
• 状态: 已接受
• VulDB条目: 397501 [Cobham SATCOM VSAT7090 Maritime Satellite Router 直到 20260704 JSON Parsing mail-report.sh c_set_reports_decode sender/recipients 权限提升]
• 积分: 20