CVE-2019-18396

An issue was discovered in certain Oi third-party firmware that may be installed on Technicolor TD5130v2 devices. A Command Injection in the Ping module in the Web Interface in OI_Fw_V20 allows remote attackers to execute arbitrary OS commands in the pingAddr parameter to mnt_ping.cgi. NOTE: This may overlap CVE-2017–14127.

CVSS v3 7.2 HIGH
CVSS v2.0 9.0 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

9.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:S/C:C/I:C/A:C

Exploitability : 8.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://packetstormsecurity.com/files/155296/Technicolor-TD5130.2-Remote-Command-Execution.html
https://medium.com/%40c4pt41nnn/cve-2019-18396-command-injection-in-technicolor-router-da5dd2134052
https://www.twitter.com/c4pt41nnn	Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:technicolor:td5130v2_firmware:oi_fw_v20:*:*:*:*:*:*:*

cpe:2.3:h:technicolor:td5130v2:-:*:*:*:*:*:*:*

History

07 Nov 2023, 03:06

Type	Values Removed	Values Added
References	{'url': 'https://medium.com/@c4pt41nnn/cve-2019-18396-command-injection-in-technicolor-router-da5dd2134052', 'name': 'https://medium.com/@c4pt41nnn/cve-2019-18396-command-injection-in-technicolor-router-da5dd2134052', 'tags': ['Exploit', 'Third Party Advisory'], 'refsource': 'MISC'}	() https://medium.com/%40c4pt41nnn/cve-2019-18396-command-injection-in-technicolor-router-da5dd2134052 -

Information

Published : 2019-10-31 20:15

Updated : 2023-12-10 13:13

NVD link : CVE-2019-18396

Mitre link : CVE-2019-18396

CVE.ORG link : CVE-2019-18396

JSON object : View

Products Affected

technicolor

td5130v2_firmware
td5130v2

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2019-18396", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2019-10-31T20:15:11.163", "references": [{"url": "http://packetstormsecurity.com/files/155296/Technicolor-TD5130.2-Remote-Command-Execution.html", "source": "cve@mitre.org"}, {"url": "https://medium.com/%40c4pt41nnn/cve-2019-18396-command-injection-in-technicolor-router-da5dd2134052", "source": "cve@mitre.org"}, {"url": "https://www.twitter.com/c4pt41nnn", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in certain Oi third-party firmware that may be installed on Technicolor TD5130v2 devices. A Command Injection in the Ping module in the Web Interface in OI_Fw_V20 allows remote attackers to execute arbitrary OS commands in the pingAddr parameter to mnt_ping.cgi. NOTE: This may overlap CVE-2017\u201314127."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en cierto firmware de terceros Oi que se puede instalar en dispositivos Technicolor TD5130v2. Una inyecci\u00f3n de comandos en el m\u00f3dulo Ping en la interfaz web en OI_Fw_V20 permite a los atacantes remotos ejecutar comandos arbitrarios del sistema operativo en el par\u00e1metro pingAddr a mnt_ping.cgi. NOTA: Esto puede superponerse a CVE-2017\u201314127."}], "lastModified": "2023-11-07T03:06:26.383", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:technicolor:td5130v2_firmware:oi_fw_v20:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DC3DDFB2-D647-49D6-82A7-B4C3D01F0BE3"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:technicolor:td5130v2:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "153E8D9D-3B2E-4143-A01F-C838A5F58589"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}