CVE-2018-7539

Опубликовано: 17 апр. 2018

Источник: nvd

CVSS3: 9.8

CVSS2: 7.8

EPSS Средний

Описание

On Appear TV XC5000 and XC5100 devices with firmware 3.26.217, it is possible to read OS files with a specially crafted HTTP request (such as GET /../../../../../../../../../../../../etc/passwd) to the web server (fuzzd/0.1.1) running the Maintenance Center on port TCP/8088. This can lead to full compromise of the device.

Ссылки

http://seclists.org/fulldisclosure/2018/Apr/34
Exploit
Mailing List
Mitigation
Third Party Advisory
http://seclists.org/fulldisclosure/2018/Apr/34
Exploit
Mailing List
Mitigation
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:appeartv:xc5000_firmware:3.26.217:*:*:*:*:*:*:*

cpe:2.3:h:appeartv:xc5000:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:o:appeartv:xc5100_firmware:3.26.217:*:*:*:*:*:*:*

cpe:2.3:h:appeartv:xc5100:-:*:*:*:*:*:*:*

EPSS

Процентиль: 95%

0.18366

Средний

9.8 Critical

CVSS3

7.8 High

CVSS2

Дефекты

CWE-22

Связанные уязвимости

GHSA-5x2r-g3pj-8qhq