CVE-2018-17534

Опубликовано: 15 окт. 2018

Источник: nvd

CVSS3: 6.8

CVSS2: 7.2

EPSS Низкий

Описание

Teltonika RUT9XX routers with firmware before 00.04.233 provide a root terminal on a serial interface without proper access control. This allows attackers with physical access to execute arbitrary commands with root privileges.

Ссылки

http://packetstormsecurity.com/files/149779/Teltonika-RUT9XX-Missing-Access-Control-To-UART-Root-Terminal.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2018/Oct/28
Exploit
Mailing List
Third Party Advisory
https://github.com/sbaresearch/advisories/tree/public/2018/SBA-ADV-20180319-02_Teltonika_Incorrect_Access_Control
Exploit
Third Party Advisory
http://packetstormsecurity.com/files/149779/Teltonika-RUT9XX-Missing-Access-Control-To-UART-Root-Terminal.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2018/Oct/28
Exploit
Mailing List
Third Party Advisory
https://github.com/sbaresearch/advisories/tree/public/2018/SBA-ADV-20180319-02_Teltonika_Incorrect_Access_Control
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:teltonika:rut900_firmware:*:*:*:*:*:*:*:*

Версия до 00.04.233 (исключая)

cpe:2.3:h:teltonika:rut900:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:o:teltonika:rut950_firmware:*:*:*:*:*:*:*:*

Версия до 00.04.233 (исключая)

cpe:2.3:h:teltonika:rut950:-:*:*:*:*:*:*:*

Конфигурация 3

Одновременно

cpe:2.3:o:teltonika:rut955_firmware:*:*:*:*:*:*:*:*

Версия до 00.04.233 (исключая)

cpe:2.3:h:teltonika:rut955:-:*:*:*:*:*:*:*

EPSS

Процентиль: 48%

0.0025

Низкий

6.8 Medium

CVSS3

7.2 High

CVSS2

Дефекты

CWE-287

Связанные уязвимости

GHSA-3gqh-4x39-jr92

CVSS3: 6.8

github

больше 3 лет назад

EPSS

Процентиль: 48%

0.0025

Низкий

6.8 Medium

CVSS3

7.2 High

CVSS2

Дефекты

CWE-287