CVE-2017-16524 File upload in n/a
Authenticated attackers can upload and execute arbitrary PHP code on Samsung SRN-1670D devices via unrestricted file upload.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-16524?
CVE-2017-16524 is a high-severity vulnerability in n/a, published on 6 Nov 2017. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Web Viewer 1.0.0.193 on Samsung SRN-1670D devices suffers from an Unrestricted file upload vulnerability: 'network_ssl_upload.php' allows remote authenticated attackers to upload and execute arbitrary PHP code via a filename with a .php extension, which is then accessed via a direct request to the file in the upload/ directory. To authenticate for this attack, one can obtain web-interface credentials in cleartext by leveraging the existing Local File Read Vulnerability referenced as CVE-2015-8279, which allows remote attackers to read the web-interface credentials via a request for the cslog_export.php?path=/root/php_modules/lighttpd/sbin/userpw URI.
Weakness: CWE-434
Which versions are affected by CVE-2017-16524?
It affects 1 product.
Products include Hanwhasecurity Web Viewer.
How do I fix CVE-2017-16524?
No fix has been published for CVE-2017-16524 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-16524 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2017-16524 exists.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry and 1 proofs of concept on GitHub.
Sources
Also known as GHSA-jgqr-hf4v-qm4q.