CVE-2019-13025

CRITICAL

9.8

Description

Compal CH7465LG CH7465LG-NCIP-6.12.18.24-5p8-NOSH devices have Incorrect Access Control because of Improper Input Validation. The attacker can send a maliciously modified POST (HTTP) request containing shell commands, which will be executed on the device, to an backend API endpoint of the cable modem.

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published10/2/2019

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

compal:ch7465lgcompal:ch7465lg_firmware

Weaknesses (CWE)

CWE-78CWE-669

References

https://xitan.me/posts/connect-box-ch7465lg-rce/(cve@mitre.org)

https://xitan.me/posts/connect-box-ch7465lg-rce/(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.