CVE-2017-9135

An issue was discovered on Mimosa Client Radios before 2.2.4 and Mimosa Backhaul Radios before 2.2.4. On the backend of the device's web interface, there are some diagnostic tests available that are not displayed on the webpage; these are only accessible by crafting a POST request with a program like cURL. There is one test accessible via cURL that does not properly sanitize user input, allowing an attacker to execute shell commands as the root user.

CVSS v3 8.8 HIGH
CVSS v2.0 9.0 HIGH

8.8^/10

CVSS v3 : HIGH

V3 Legend

Vector : AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

9.0^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:S/C:C/I:C/A:C

Exploitability : 8.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://blog.iancaling.com/post/160596244178	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:mimosa:backhaul_radios::::::::
	cpe:2.3:o:mimosa:client_radios::::::::

History

No history.

Information

Published : 2017-05-21 21:29

Updated : 2017-05-26 13:19

NVD link : CVE-2017-9135

Mitre link : CVE-2017-9135

CVE.ORG link : CVE-2017-9135

JSON object : View

Products Affected

mimosa

client_radios
backhaul_radios

CWE

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

{"id": "CVE-2017-9135", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": true, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2017-05-21T21:29:00.330", "references": [{"url": "http://blog.iancaling.com/post/160596244178", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-74"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered on Mimosa Client Radios before 2.2.4 and Mimosa Backhaul Radios before 2.2.4. On the backend of the device's web interface, there are some diagnostic tests available that are not displayed on the webpage; these are only accessible by crafting a POST request with a program like cURL. There is one test accessible via cURL that does not properly sanitize user input, allowing an attacker to execute shell commands as the root user."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en Mimosa Client Radios anterior a versi\u00f3n 2.2.4 y Mimosa backhaul Radios anterior a versi\u00f3n 2.2.4. En el backend de la interfaz web del dispositivo, existen algunas pruebas de diagn\u00f3stico disponibles que no se muestran en la p\u00e1gina web; solo pueden ser accesibles mediante el dise\u00f1o de una petici\u00f3n POST con un programa como cURL. Hay una prueba accesible por medio de cURL que no sanea apropiadamente la entrada del usuario, lo que permite a un atacante ejecutar comandos de shell como usuario root."}], "lastModified": "2017-05-26T13:19:54.883", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:mimosa:backhaul_radios:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D9CDC98A-8138-492B-A781-B592A362EFB0", "versionEndIncluding": "2.2.3"}, {"criteria": "cpe:2.3:o:mimosa:client_radios:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "37609F06-F95C-43CB-8581-B9C0C197EA2B", "versionEndIncluding": "2.2.3"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}

8.8 /10