Vulnerability CVE-2014-9118
Published: 2017-10-17

Description:
The web administrative portal in Zhone zNID GPON 2426A before S3.0.501 allows remote attackers to execute arbitrary commands via shell metacharacters in the ipAddr parameter to zhnping.cmd.

See advisories in our WLB2 database:
Topic
Author
Date
High
Zhone Insecure Reference / Password Disclosure / Command Injection
Lyon Yang
13.10.2015

Type:

CWE-77

 (Improper Neutralization of Special Elements used in a Command ('Command Injection'))

CVSS2 => (AV:N/AC:L/Au:S/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
9/10
10/10
8/10
Exploit range
Attack complexity
Authentication
Remote
Low
Single time
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete
Affected software
Dasanzhone -> Znid 2426a firmware 

 References:
http://packetstormsecurity.com/files/133921/Zhone-Insecure-Reference-Password-Disclosure-Command-Injection.html
http://seclists.org/fulldisclosure/2015/Oct/57
http://www.securityfocus.com/archive/1/536663/100/0/threaded
https://www.exploit-db.com/exploits/38453/
Copyright 2024, cxsecurity.com

 

Back to Top