high8.8Public exploit code
CVE-2014-9118
The web administrative portal in Zhone zNID GPON 2426A before S3.0.501 allows remote attackers to execute arbitrary commands via shell metacharacters in the ip…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- ZHONE < S3.0.501 - Multiple Vulnerabilities2015-10-13 · remote · hardware
Impact
The web administrative portal in Zhone zNID GPON 2426A before S3.0.501 allows remote attackers to execute arbitrary commands via shell metacharacters in the ipAddr parameter to zhnping.cmd.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dasanzhone | Znid 2426a Firmware | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/133921/Zhone-Insecure-Reference-Password-Disclosure-Command-Injection.html
- http://seclists.org/fulldisclosure/2015/Oct/57
- http://www.securityfocus.com/archive/1/536663/100/0/threaded
- https://www.exploit-db.com/exploits/38453/
- http://packetstormsecurity.com/files/133921/Zhone-Insecure-Reference-Password-Disclosure-Command-Injection.html
- http://seclists.org/fulldisclosure/2015/Oct/57
- http://www.securityfocus.com/archive/1/536663/100/0/threaded
- https://www.exploit-db.com/exploits/38453/