high7.2Public exploit code
CVE-2023-26609
ABUS TVIP 20000-21150 devices allows remote attackers to execute arbitrary code via shell metacharacters in the /cgi-bin/mft/wireless_mft ap field.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- ABUS Security Camera TVIP 20000-21150 - LFI_ RCE and SSH Root Access2023-04-06 · remote · hardware
Impact
ABUS TVIP 20000-21150 devices allows remote attackers to execute arbitrary code via shell metacharacters in the /cgi-bin/mft/wireless_mft ap field.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Abus | Tvip 20000-21150 Firmware | All versions |
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/171136/ABUS-Security-Camera-TVIP-20000-21150-LFI-Remote-Code-Execution.html
- http://seclists.org/fulldisclosure/2023/Feb/16
- https://nwsec.de/NWSSA-001-2023.txt
- http://packetstormsecurity.com/files/171136/ABUS-Security-Camera-TVIP-20000-21150-LFI-Remote-Code-Execution.html
- http://seclists.org/fulldisclosure/2023/Feb/16
- https://nwsec.de/NWSSA-001-2023.txt