Lucene search

MitreCVE-2017-6079

HistoryMay 16, 2017 - 5:29 p.m.

CVE-2017-6079

2017-05-1617:29:00

mitre

web.nvd.nist.gov

In Wild

cve-2017-6079

edgewater networks

edgemarc

web management

unauthorized command execution

firmware vulnerability

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.007

Percentile

80.8%

JSON

The HTTP web-management application on Edgewater Networks Edgemarc appliances has a hidden page that allows for user-defined commands such as specific iptables routes, etc., to be set. You can use this page as a web shell essentially to execute commands, though you get no feedback client-side from the web application: if the command is valid, it executes. An example is the wget command. The page that allows this has been confirmed in firmware as old as 2006.

Affected configurations

Nvd

Node

ribboncommunicationsedgemarc_4550Match-

ribboncommunicationsedgemarc_4552Match-

ribboncommunicationsedgemarc_4601Match-

ribboncommunicationsedgemarc_4700Match-

ribboncommunicationsedgemarc_4750Match-

ribboncommunicationsedgemarc_4800Match-

ribboncommunicationsedgemarc_4806Match-

ribboncommunicationsedgemarc_4808Match-

ribboncommunicationsedgemarc_7301Match-

ribboncommunicationsedgemarc_7400Match-

AND

ribboncommunicationsedgemarc_firmwareMatch-

VendorProductVersionCPE
ribboncommunicationsedgemarc_4550-cpe:2.3:h:ribboncommunications:edgemarc_4550:-:*:*:*:*:*:*:*
ribboncommunicationsedgemarc_4552-cpe:2.3:h:ribboncommunications:edgemarc_4552:-:*:*:*:*:*:*:*
ribboncommunicationsedgemarc_4601-cpe:2.3:h:ribboncommunications:edgemarc_4601:-:*:*:*:*:*:*:*
ribboncommunicationsedgemarc_4700-cpe:2.3:h:ribboncommunications:edgemarc_4700:-:*:*:*:*:*:*:*
ribboncommunicationsedgemarc_4750-cpe:2.3:h:ribboncommunications:edgemarc_4750:-:*:*:*:*:*:*:*
ribboncommunicationsedgemarc_4800-cpe:2.3:h:ribboncommunications:edgemarc_4800:-:*:*:*:*:*:*:*
ribboncommunicationsedgemarc_4806-cpe:2.3:h:ribboncommunications:edgemarc_4806:-:*:*:*:*:*:*:*
ribboncommunicationsedgemarc_4808-cpe:2.3:h:ribboncommunications:edgemarc_4808:-:*:*:*:*:*:*:*
ribboncommunicationsedgemarc_7301-cpe:2.3:h:ribboncommunications:edgemarc_7301:-:*:*:*:*:*:*:*
ribboncommunicationsedgemarc_7400-cpe:2.3:h:ribboncommunications:edgemarc_7400:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ribboncommunications	edgemarc_4550	-	cpe:2.3:h:ribboncommunications:edgemarc_4550:-:::::::*
ribboncommunications	edgemarc_4552	-	cpe:2.3:h:ribboncommunications:edgemarc_4552:-:::::::*
ribboncommunications	edgemarc_4601	-	cpe:2.3:h:ribboncommunications:edgemarc_4601:-:::::::*
ribboncommunications	edgemarc_4700	-	cpe:2.3:h:ribboncommunications:edgemarc_4700:-:::::::*
ribboncommunications	edgemarc_4750	-	cpe:2.3:h:ribboncommunications:edgemarc_4750:-:::::::*
ribboncommunications	edgemarc_4800	-	cpe:2.3:h:ribboncommunications:edgemarc_4800:-:::::::*
ribboncommunications	edgemarc_4806	-	cpe:2.3:h:ribboncommunications:edgemarc_4806:-:::::::*
ribboncommunications	edgemarc_4808	-	cpe:2.3:h:ribboncommunications:edgemarc_4808:-:::::::*
ribboncommunications	edgemarc_7301	-	cpe:2.3:h:ribboncommunications:edgemarc_7301:-:::::::*
ribboncommunications	edgemarc_7400	-	cpe:2.3:h:ribboncommunications:edgemarc_7400:-:::::::*

Rows per page:

1-10 of 111

References

depthsecurity.com/blog/cve-2017-6079-blind-command-injection-in-edgewater-edgemarc-devices

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.007

Percentile

80.8%

JSON

Related for CVE-2017-6079