CVE-2023-35193

CVE-2023-35193 affects Peplink Surf SOHO HW1 v6.3.5 (in QEMU). Talos reports an OS command injection in api.cgi (cmd.mvpn.x509.write) where an attacker-authenticated user can craft HTTP POST parameters (cert, key, pw) to trigger root-level commands via system(). The vulnerable code builds and exe...

peplink Surf SOHO HW1 api.cgi cmd.mvpn.x509.write OS command injection vulnerability

Talos Vulnerability Report TALOS-2023-1782 peplink Surf SOHO HW1 api.cgi cmd.mvpn.x509.write OS command injection vulnerability October 11, 2023 CVE Number CVE-2023-35194,CVE-2023-35193 SUMMARY An OS command injection vulnerability exists in the api.cgi cmd.mvpn.x509.write functionality of peplin...