CVE-2024-37570

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-37570
On Mitel 6869i 4.5.0.41 devices, the Manual Firmware Update (upgrade.html) page does not perform sanitization on the username and path parameters (sent by an authenticated user) before appending flags to the busybox ftpget command. This leads to $() command execution.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/kwburns/CVE/blob/main/Mitel/5.0.0.1018/code/exploit-firmware.py Product
https://github.com/kwburns/CVE/tree/main/Mitel/5.0.0.1018#authenticated-remote-command-execution-firmware Exploit Third Party Advisory
https://github.com/kwburns/CVE/blob/main/Mitel/5.0.0.1018/code/exploit-firmware.py Product
https://github.com/kwburns/CVE/tree/main/Mitel/5.0.0.1018#authenticated-remote-command-execution-firmware Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:mitel:6869i_sip_firmware:4.5.0.41:*:*:*:*:*:*:*
cpe:2.3:h:mitel:6869i_sip:-:*:*:*:*:*:*:*
History

21 Nov 2024, 09:24

Type Values Removed Values Added
References () https://github.com/kwburns/CVE/blob/main/Mitel/5.0.0.1018/code/exploit-firmware.py - Product () https://github.com/kwburns/CVE/blob/main/Mitel/5.0.0.1018/code/exploit-firmware.py - Product
References () https://github.com/kwburns/CVE/tree/main/Mitel/5.0.0.1018#authenticated-remote-command-execution-firmware - Exploit, Third Party Advisory () https://github.com/kwburns/CVE/tree/main/Mitel/5.0.0.1018#authenticated-remote-command-execution-firmware - Exploit, Third Party Advisory

25 Oct 2024, 19:35

Type Values Removed Values Added
CWE CWE-75

01 Aug 2024, 13:53

Type Values Removed Values Added
CWE CWE-75

12 Jun 2024, 16:32

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8
References () https://github.com/kwburns/CVE/blob/main/Mitel/5.0.0.1018/code/exploit-firmware.py - () https://github.com/kwburns/CVE/blob/main/Mitel/5.0.0.1018/code/exploit-firmware.py - Product
References () https://github.com/kwburns/CVE/tree/main/Mitel/5.0.0.1018#authenticated-remote-command-execution-firmware - () https://github.com/kwburns/CVE/tree/main/Mitel/5.0.0.1018#authenticated-remote-command-execution-firmware - Exploit, Third Party Advisory
First Time Mitel 6869i Sip
Mitel 6869i Sip Firmware
Mitel
CPE cpe:2.3:h:mitel:6869i_sip:-:*:*:*:*:*:*:*
cpe:2.3:o:mitel:6869i_sip_firmware:4.5.0.41:*:*:*:*:*:*:*
Summary
  • (es) En dispositivos Mitel 6869i 4.5.0.41, la página Actualización manual de firmware (upgrade.html) no realiza sanitización en los parámetros de nombre de usuario y ruta (enviados por un usuario autenticado) antes de agregar indicadores al comando ftpget de Busybox. Esto lleva a la ejecución del comando $().
CWE CWE-77

09 Jun 2024, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-09 20:15

Updated : 2024-11-21 09:24

NVD link : CVE-2024-37570

Mitre link : CVE-2024-37570

CVE.ORG link : CVE-2024-37570

JSON object : View

Products Affected

mitel

  • 6869i_sip
  • 6869i_sip_firmware
CWE
CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')