PT-2021-17611
CVE-2021-27708
·
تاريخ النشر
2021-04-14
·
تاريخ التحديث
2021-04-21
الوصف من
CVSS 3.1
10
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions:
TOTOLINK X5000R version v9.1.0u.6118 B20201102
TOTOLINK A720R version v4.1.5cu.470 B20200911
Description:
The issue allows remote attackers to execute arbitrary OS commands by sending a modified HTTP request. This occurs because a function executes glibc's system function with untrusted input. The
command parameter is directly passed to the attacker, allowing them to control the command field and attack the OS.Recommendations:
For TOTOLINK X5000R version v9.1.0u.6118 B20201102, consider disabling the function that executes the system command with untrusted input until a patch is available.
For TOTOLINK A720R version v4.1.5cu.470 B20200911, restrict access to the
command parameter in the affected HTTP request to minimize the risk of exploitation.قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾