CVE-2017-18368Zyxel P660HN-T1A Routers Command Injection Vulnerability
Aktif olarak istismar ediliyor — Zyxel P660HN-T1A Routers Command Injection Vulnerability
CISA bu açığın gerçek saldırılarda kullanıldığını 07.08.2023 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 28.08.2023.
Gerekli işlem: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-a-new-variant-of-gafgyt-malware; https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-vulnerability-in-p660hn-t1a-dsl-cpe; https://nvd.nist.gov/vuln/detail/CVE-2017-18368
Açıklama
The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user. The vulnerability is in the ViewLog.asp page and can be exploited through the remote_host parameter.
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| billion | 5200w-t firmware | 7.3.8.0 | |
| zyxel | p660hn-t1a v1 firmware | 7.3.15.0 | |
| zyxel | p660hn-t1a v2 firmware | 7.3.15.0 |
Kaynaklar ve yamalar
- https://seclists.org/fulldisclosure/2017/Jan/40 ExploitMailing ListThird Party Advisory
- https://ssd-disclosure.com/index.php/archives/2910 ExploitTechnical DescriptionThird Party Advisory
- https://unit42.paloaltonetworks.com/new-mirai-variant-targets-enterprise-wireless-presentation-display-systems/ Technical DescriptionThird Party Advisory
- https://raw.githubusercontent.com/pedrib/PoC/master/advisories/zyxel_trueonline.txt ExploitThird Party Advisory
- http://www.zyxel.com/support/announcement_unauthenticated.shtml Broken Link
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-18368 US Government Resource
CPE eşleşmeleri (NVD) (3)
cpe:2.3:o:billion:5200w-t_firmware:7.3.8.0:*:*:*:*:*:*:*cpe:2.3:o:zyxel:p660hn-t1a_v2_firmware:7.3.15.0:*:*:*:*:*:*:*cpe:2.3:o:zyxel:p660hn-t1a_v1_firmware:7.3.15.0:*:*:*:*:*:*:*