CVE-2018-17532

Teltonika RUT9XX routers with firmware before 00.04.233 are prone to multiple unauthenticated OS command injection vulnerabilities in autologin.cgi and hotspotlogin.cgi due to insufficient user input sanitization. This allows remote attackers to execute arbitrary commands with root privileges.

CVSS v3 9.8 CRITICAL
CVSS v2.0 10.0 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://packetstormsecurity.com/files/149777/Teltonika-RUT9XX-Unauthenticated-OS-Command-Injection.html	Exploit Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2018/Oct/27	Exploit Mailing List Third Party Advisory
https://github.com/sbaresearch/advisories/tree/public/2018/SBA-ADV-20180319-01_Teltonika_OS_Command_Injection	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:teltonika:rut900_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:teltonika:rut900:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:teltonika:rut950_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:teltonika:rut950:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:teltonika:rut955_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:teltonika:rut955:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-10-15 19:29

Updated : 2024-02-04 20:03

NVD link : CVE-2018-17532

Mitre link : CVE-2018-17532

CVE.ORG link : CVE-2018-17532

JSON object : View

Products Affected

teltonika

rut955_firmware
rut950_firmware
rut950
rut900_firmware
rut955
rut900

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2018-17532", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2018-10-15T19:29:01.617", "references": [{"url": "http://packetstormsecurity.com/files/149777/Teltonika-RUT9XX-Unauthenticated-OS-Command-Injection.html", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://seclists.org/fulldisclosure/2018/Oct/27", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/sbaresearch/advisories/tree/public/2018/SBA-ADV-20180319-01_Teltonika_OS_Command_Injection", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Teltonika RUT9XX routers with firmware before 00.04.233 are prone to multiple unauthenticated OS command injection vulnerabilities in autologin.cgi and hotspotlogin.cgi due to insufficient user input sanitization. This allows remote attackers to execute arbitrary commands with root privileges."}, {"lang": "es", "value": "Los routers Teltonika RUT9XX con firmware en versiones anteriores a la 00.04.233 son propensos a sufrir m\u00faltiples vulnerabilidades de inyecci\u00f3n de comandos del sistema operativo sin autenticar en autologin.cgi y hotspotlogin.cgi debido al saneamiento insuficiente de entradas de usuario. Esto permite que los atacantes remotos ejecuten comandos arbitrarios con privilegios root."}], "lastModified": "2018-11-30T14:12:57.920", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:teltonika:rut900_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1FAF23FC-E917-4BF6-91EA-3841C8A85072", "versionEndExcluding": "00.04.233"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:teltonika:rut900:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D9D1E794-1212-43CC-BA30-551EE45FA646"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:teltonika:rut950_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B1125937-EF97-4862-B975-73EA8D3E1F6F", "versionEndExcluding": "00.04.233"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:teltonika:rut950:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "4CE17C85-9A69-41FB-AB96-0DCAB72309A0"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:teltonika:rut955_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BC247689-3C29-44DB-8F36-70732EB5BBFF", "versionEndExcluding": "00.04.233"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:teltonika:rut955:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "6F29C3F1-DFAF-433A-8B1E-4BD2A8DF6C1E"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}