CVE-2017-9807: Improper Control of Generation of Code

An issue was discovered in the OpenWebif plugin through 1.2.4 for E2 open devices. The saveConfig function of "plugin/controllers/models/config.py" performs an eval call on the contents of the "key" HTTP GET parameter. This allows an unauthenticated remote attacker to execute arbitrary Python cod...

PT-2017-19199

Name of the Vulnerable Software and Affected Versions OpenWebif plugin through 1.2.4 for E2 open devices Description An issue in the OpenWebif plugin allows an unauthenticated remote attacker to execute arbitrary Python code or OS commands. This is due to the saveConfig function in...