Command injection

2021-11-0320:15:00

PRIOn knowledge base

www.prio-n.com

8.5 High

AI Score

Confidence

High

0.021 Low

EPSS

Percentile

89.1%

JSON

In Ericsson Network Location before 2021-07-31, it is possible for an authenticated attacker to inject commands via file_name in the export functionality. For example, a new admin user could be created.

CPENameOperatorVersion
network_locationeq< 2021731

CPE	Name	Operator	Version
	network_location	eq	< 2021731

References

pentest.com.tr/blog/RCE-via-Meow-Variant-along-with-an-Example-0day-PacketHackingVillage-Defcon29.html

www.exploit-db.com/exploits/50468

www.exploit-db.com/exploits/50469