The api/ZRFirmware/set_time_zone interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the zonename parameter.
References
Link | Resource |
---|---|
http://iot.10086.cn/?l=en-us | Product |
https://github.com/pokerfacett/MY_REQUEST/blob/master/China%20Mobile%20An%20Lianbao%20WF-1%20router%20Command%20Injection5.md | Exploit Third Party Advisory |
https://www.cnvd.org.cn/flaw/show/CNVD-2021-03520 | Third Party Advisory |
Configurations
Configuration 1 (hide)
AND |
|
History
03 May 2022, 16:04
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-78 |
07 May 2021, 18:30
Type | Values Removed | Values Added |
---|---|---|
References | (MISC) http://iot.10086.cn/?l=en-us - Product | |
References | (MISC) https://github.com/pokerfacett/MY_REQUEST/blob/master/China%20Mobile%20An%20Lianbao%20WF-1%20router%20Command%20Injection5.md - Exploit, Third Party Advisory | |
References | (MISC) https://www.cnvd.org.cn/flaw/show/CNVD-2021-03520 - Third Party Advisory | |
CWE | CWE-77 | |
CPE | cpe:2.3:h:chinamobile:an_lianbao_wf-1:-:*:*:*:*:*:*:* cpe:2.3:o:chinamobile:an_lianbao_wf-1_firmware:1.0.1:*:*:*:*:*:*:* |
|
CVSS |
v2 : v3 : |
v2 : 7.5
v3 : 9.8 |
29 Apr 2021, 16:48
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2021-04-29 16:15
Updated : 2023-12-10 13:55
NVD link : CVE-2021-30230
Mitre link : CVE-2021-30230
CVE.ORG link : CVE-2021-30230
JSON object : View
Products Affected
chinamobile
- an_lianbao_wf-1_firmware
- an_lianbao_wf-1
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')