high8.8Public exploit code
CVE-2017-17867
Inteno iopsys 2.0-3.14 and 4.0 devices allow remote authenticated users to execute arbitrary OS commands by modifying the leasetrigger field in the odhcpd conf…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Iopsys Router - 'dhcp' Remote Code Execution2017-12-23 · remote · hardware
Impact
Inteno iopsys 2.0-3.14 and 4.0 devices allow remote authenticated users to execute arbitrary OS commands by modifying the leasetrigger field in the odhcpd configuration to specify an arbitrary program, as demonstrated by a program located on an SMB share. This issue existed because the /etc/uci-defaults directory was not being used to secure the OpenWrt configuration.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Intenogroup | Iopsys | from 2.0 through 3.14 Version 4.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://public.inteno.se/?p=feed-inteno-openwrt.git%3Ba=commit%3Bh=efcc985a721107e72a66da4db66891ec54441998
- https://neonsea.uk/blog/2017/12/23/rce-inteno-iopsys.html
- https://www.exploit-db.com/exploits/43428/
- http://public.inteno.se/?p=feed-inteno-openwrt.git%3Ba=commit%3Bh=efcc985a721107e72a66da4db66891ec54441998
- https://neonsea.uk/blog/2017/12/23/rce-inteno-iopsys.html
- https://www.exploit-db.com/exploits/43428/