ID
VAR-E-201307-0359
CVE
| cve_id: | CVE-2013-2612 | Trust: 0.5 |
TITLE
Huawei E587 3G Mobile Hotspot Command Injection
Trust: 0.5
DESCRIPTION
Huawei E587 3G Mobile Hotspot version 11.203.27 is prone to a command injection vulnerability in the Web UI. Successful exploitation allows unauthenticated attackers to execute arbitrary commands with root privileges.
Trust: 0.5
AFFECTED PRODUCTS
| vendor: | huawei | model: | e587 3g mobile hotspot | scope: | - | version: | - | Trust: 0.5 |
EXPLOIT
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
[CVE-2013-2612] Huawei E587 3G Mobile Hotspot Command Injection
________________________________________________________________________
Summary:
Huawei E587 3G Mobile Hotspot, version 11.203.27, is prone to a command
injection vulnerability in the Web UI.
Successful exploitation allows unauthenticated attackers to execute
arbitrary commands with root privileges.
________________________________________________________________________
Details:
The HTTP endpoint "/api/device/time" in Web UI is vulnerable to shell
command injection. This allows code execution with root privileges.
________________________________________________________________________
CVSS Version 2 Metrics:
Access Vector: Network exploitable
Access Complexity: Low
Authentication: Not required to exploit
Confidentiality Impact: Complete
Integrity Impact: Complete
Availability Impact: Complete
________________________________________________________________________
Disclosure Timeline:
2013-03-18 Vendor notified
2013-03-18 CVE-2013-2612 assigned
2013-07-15 Public advisory
________________________________________________________________________
References:
http://www.huawei.com/en/security/psirt/
________________________________________________________________________
Frédéric Basse
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iQEcBAEBAgAGBQJR48qZAAoJENQ4kG3hg80AJMEH/Rdyx2zmDPzr2Ar5Nc+Fw1ih
aiby28PhIKfXhAst2SrkIp6ogtDEj+PBrgbEy2YJlyKi01z1Uf2UGukxijlQTg7H
0zYivz55vleBrr9OD/A2pxo7sZZy7eswH5jia5abRUVXYYqEVWYp5KWvzbMPO3CY
EgLYxE4uv00ojqHCl9QsD7oa+mR52Jur3QZ/IdCbJJZgmEKmwNJvJ8rb6RvTMcae
+8dWhC8bhfL3UkTW5snYZ4K/euA84LmGvcfd1PXrMAX01xXDdnPJ/JxrzSPLfb1x
6WyZO6cZpgxQqvogemXKOy2MmnNkWlkK0P9OmmDpBQBI66WnyBUxXNFxEr/HFKo=
=6yIl
-----END PGP SIGNATURE-----
Trust: 0.5
EXPLOIT HASH
LOCAL | SOURCE | ||||||||
|
|
Trust: 0.5
PRICE
free
Trust: 0.5
TYPE
arbitrary, root
Trust: 0.5
TAGS
| tag: | exploit | Trust: 0.5 |
| tag: | web | Trust: 0.5 |
| tag: | arbitrary | Trust: 0.5 |
| tag: | root | Trust: 0.5 |
CREDITS
Frederic Basse
Trust: 0.5
EXTERNAL IDS
| db: | NVD | id: | CVE-2013-2612 | Trust: 0.5 |
| db: | PACKETSTORM | id: | 122408 | Trust: 0.5 |
REFERENCES
| url: | https://nvd.nist.gov/vuln/detail/cve-2013-2612 | Trust: 0.5 |
SOURCES
| db: | PACKETSTORM | id: | 122408 |
LAST UPDATE DATE
2022-07-27T09:54:24.361000+00:00
SOURCES RELEASE DATE
| db: | PACKETSTORM | id: | 122408 | date: | 2013-07-15T17:21:11 |