high7.2Public exploit code
CVE-2019-18396
An issue was discovered in certain Oi third-party firmware that may be installed on Technicolor TD5130v2 devices.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Technicolor TD5130.2 - Remote Command Execution2019-11-13 · webapps · hardware
Impact
An issue was discovered in certain Oi third-party firmware that may be installed on Technicolor TD5130v2 devices. A Command Injection in the Ping module in the Web Interface in OI_Fw_V20 allows remote attackers to execute arbitrary OS commands in the pingAddr parameter to mnt_ping.cgi. NOTE: This may overlap CVE-2017–14127.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Technicolor | Td5130v2 Firmware | Version oi_fw_v20 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/155296/Technicolor-TD5130.2-Remote-Command-Execution.html
- https://medium.com/%40c4pt41nnn/cve-2019-18396-command-injection-in-technicolor-router-da5dd2134052
- https://www.twitter.com/c4pt41nnn
- http://packetstormsecurity.com/files/155296/Technicolor-TD5130.2-Remote-Command-Execution.html
- https://medium.com/%40c4pt41nnn/cve-2019-18396-command-injection-in-technicolor-router-da5dd2134052
- https://www.twitter.com/c4pt41nnn