The HTTP web-management application on Edgewater Networks Edgemarc appliances has a hidden page that allows for user-defined commands such as specific iptables routes, etc., to be set. You can use this page as a web shell essentially to execute commands, though you get no feedback client-side from the web application: if the command is valid, it executes. An example is the wget command. The page that allows this has been confirmed in firmware as old as 2006.
References
| Link | Resource |
|---|---|
| https://depthsecurity.com/blog/cve-2017-6079-blind-command-injection-in-edgewater-edgemarc-devices | Exploit Technical Description Third Party Advisory |
| https://depthsecurity.com/blog/cve-2017-6079-blind-command-injection-in-edgewater-edgemarc-devices | Exploit Technical Description Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
21 Nov 2024, 03:29
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://depthsecurity.com/blog/cve-2017-6079-blind-command-injection-in-edgewater-edgemarc-devices - Exploit, Technical Description, Third Party Advisory |
13 Sep 2021, 11:20
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:ribboncommunications:edgemarc_firmware:-:*:*:*:*:*:*:* |
09 Jul 2021, 14:28
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:h:edgewater_networks:edgemarc_4552:-:*:*:*:*:*:*:* cpe:2.3:h:edgewater_networks:edgemarc_4550:-:*:*:*:*:*:*:* cpe:2.3:h:edgewater_networks:edgemarc_4700:-:*:*:*:*:*:*:* cpe:2.3:h:edgewater_networks:edgemarc_4750:-:*:*:*:*:*:*:* cpe:2.3:h:edgewater_networks:edgemarc_4808:-:*:*:*:*:*:*:* cpe:2.3:h:edgewater_networks:edgemarc_4806:-:*:*:*:*:*:*:* cpe:2.3:h:edgewater_networks:edgemarc_4800:-:*:*:*:*:*:*:* cpe:2.3:h:edgewater_networks:edgemarc_7400:-:*:*:*:*:*:*:* cpe:2.3:h:edgewater_networks:edgemarc_4601:-:*:*:*:*:*:*:* |
cpe:2.3:h:ribboncommunications:edgemarc_4808:-:*:*:*:*:*:*:* cpe:2.3:h:ribboncommunications:edgemarc_4800:-:*:*:*:*:*:*:* cpe:2.3:h:ribboncommunications:edgemarc_7400:-:*:*:*:*:*:*:* cpe:2.3:h:ribboncommunications:edgemarc_4601:-:*:*:*:*:*:*:* cpe:2.3:h:ribboncommunications:edgemarc_4552:-:*:*:*:*:*:*:* cpe:2.3:h:ribboncommunications:edgemarc_7301:-:*:*:*:*:*:*:* cpe:2.3:h:ribboncommunications:edgemarc_4700:-:*:*:*:*:*:*:* cpe:2.3:h:ribboncommunications:edgemarc_4806:-:*:*:*:*:*:*:* cpe:2.3:h:ribboncommunications:edgemarc_4550:-:*:*:*:*:*:*:* cpe:2.3:h:ribboncommunications:edgemarc_4750:-:*:*:*:*:*:*:* |
Information
Published : 2017-05-16 17:29
Updated : 2024-11-21 03:29
NVD link : CVE-2017-6079
Mitre link : CVE-2017-6079
CVE.ORG link : CVE-2017-6079
JSON object : View
Products Affected
ribboncommunications
- edgemarc_4700
- edgemarc_4808
- edgemarc_4750
- edgemarc_4550
- edgemarc_4601
- edgemarc_firmware
- edgemarc_7400
- edgemarc_7301
- edgemarc_4800
- edgemarc_4806
- edgemarc_4552
CWE