CVE-2017-6048 Command injection in Satel Iberia SenNet Data Logger and Electricity Meters
Attackers can execute arbitrary commands to escape the jailed shell and gain full system access on SenNet Data Loggers and Electricity Meters.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-6048?
CVE-2017-6048 is a high-severity command injection vulnerability in Satel Iberia SenNet Data Logger and Electricity Meters, published on 19 May 2017. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A Command Injection issue was discovered in Satel Iberia SenNet Data Logger and Electricity Meters: SenNet Optimal DataLogger V5.37c-1.43c and prior, SenNet Solar Datalogger V5.03-1.56a and prior, and SenNet Multitask Meter V5.21a-1.18b and prior. Successful exploitation of this vulnerability could result in the attacker breaking out of the jailed shell and gaining full access to the system.
Weakness: CWE-77
Which versions are affected by CVE-2017-6048?
It affects 3 products.
Products include Satel-Iberia Sennet Multitask Meter, Satel-Iberia Sennet Optimal Datalogger, Satel-Iberia Sennet Solar Datalogger.
How do I fix CVE-2017-6048?
No fix has been published for CVE-2017-6048 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2017-6048 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2017-6048 exists.
Public exploit code: 1 Metasploit module.
Sources
Also known as GHSA-m2vj-hfvw-94qp.