CVE-2018-17173

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

• LG Supersign EZ CMS - Remote Code Execution (Metasploit)2019-05-06 · remote · hardware
• LG SuperSign EZ CMS 2.5 - Remote Code Execution2018-09-24 · webapps · hardware

Impact

LG SuperSign CMS allows remote attackers to execute arbitrary code via the sourceUri parameter to qsr_server/device/getThumbnail.

Affected products

Weakness classification

References

• NVD record
• CVE.org record
• http://mamaquieroserpentester.blogspot.com/2018/09/lg-supersign-rce-to-luna-and-back-to.html
• http://packetstormsecurity.com/files/152733/LG-Supersign-EZ-CMS-Remote-Code-Execution.html
• https://www.exploit-db.com/exploits/45448/
• https://www.exploit-db.com/exploits/46795/
• http://mamaquieroserpentester.blogspot.com/2018/09/lg-supersign-rce-to-luna-and-back-to.html
• http://packetstormsecurity.com/files/152733/LG-Supersign-EZ-CMS-Remote-Code-Execution.html
• https://www.exploit-db.com/exploits/45448/
• https://www.exploit-db.com/exploits/46795/