Lucene search

MitreCVE-2021-36705

HistoryAug 06, 2021 - 2:15 p.m.

CVE-2021-36705

2021-08-0614:15:07

CWE-78

mitre

web.nvd.nist.gov

cve-2021-36705

prolink

prc2402m

v1.0.18

command injection

adm.cgi

tr069

nvd

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.029

Percentile

91.0%

JSON

In ProLink PRC2402M V1.0.18 and older, the set_TR069 function in the adm.cgi binary, accessible with a page parameter value of TR069 contains a trivial command injection where the value of the TR069_local_port parameter is passed directly to system.

Affected configurations

Nvd

Node

prolinkprc2402mMatch-

AND

prolinkprc2402m_firmwareRange≤1.0.18

VendorProductVersionCPE
prolinkprc2402m-cpe:2.3:h:prolink:prc2402m:-:*:*:*:*:*:*:*
prolinkprc2402m_firmware*cpe:2.3:o:prolink:prc2402m_firmware:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
prolink	prc2402m	-	cpe:2.3:h:prolink:prc2402m:-:::::::*
prolink	prc2402m_firmware	*	cpe:2.3:o:prolink:prc2402m_firmware::::::::

References

www.ayrx.me/prolink-prc2402m-multiple-vulnerabilities/#tr069-command-injection

Social References

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.029

Percentile

91.0%

JSON

Related for CVE-2021-36705