Lucene search

MitreCVE-2018-17532

HistoryOct 15, 2018 - 7:29 p.m.

CVE-2018-17532

2018-10-1519:29:01

CWE-78

mitre

web.nvd.nist.gov

teltonika

rut9xx

routers

firmware

command injection

os vulnerability

nvd

cve-2018-17532

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.004

Percentile

74.0%

JSON

Teltonika RUT9XX routers with firmware before 00.04.233 are prone to multiple unauthenticated OS command injection vulnerabilities in autologin.cgi and hotspotlogin.cgi due to insufficient user input sanitization. This allows remote attackers to execute arbitrary commands with root privileges.

Affected configurations

Nvd

Node

teltonikarut900_firmwareRange<00.04.233

AND

teltonikarut900Match-

Node

teltonikarut950_firmwareRange<00.04.233

AND

teltonikarut950Match-

Node

teltonikarut955_firmwareRange<00.04.233

AND

teltonikarut955Match-

VendorProductVersionCPE
teltonikarut900_firmware*cpe:2.3:o:teltonika:rut900_firmware:*:*:*:*:*:*:*:*
teltonikarut900-cpe:2.3:h:teltonika:rut900:-:*:*:*:*:*:*:*
teltonikarut950_firmware*cpe:2.3:o:teltonika:rut950_firmware:*:*:*:*:*:*:*:*
teltonikarut950-cpe:2.3:h:teltonika:rut950:-:*:*:*:*:*:*:*
teltonikarut955_firmware*cpe:2.3:o:teltonika:rut955_firmware:*:*:*:*:*:*:*:*
teltonikarut955-cpe:2.3:h:teltonika:rut955:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
teltonika	rut900_firmware	*	cpe:2.3:o:teltonika:rut900_firmware::::::::
teltonika	rut900	-	cpe:2.3:h:teltonika:rut900:-:::::::*
teltonika	rut950_firmware	*	cpe:2.3:o:teltonika:rut950_firmware::::::::
teltonika	rut950	-	cpe:2.3:h:teltonika:rut950:-:::::::*
teltonika	rut955_firmware	*	cpe:2.3:o:teltonika:rut955_firmware::::::::
teltonika	rut955	-	cpe:2.3:h:teltonika:rut955:-:::::::*

References

packetstormsecurity.com/files/149777/Teltonika-RUT9XX-Unauthenticated-OS-Command-Injection.html

seclists.org/fulldisclosure/2018/Oct/27

github.com/sbaresearch/advisories/tree/public/2018/SBA-ADV-20180319-01_Teltonika_OS_Command_Injection

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.004

Percentile

74.0%

JSON

Related for CVE-2018-17532