CVE-2019-7384 Command injection in n/a
Authenticated attackers can execute arbitrary shell commands on Raisecom GPON devices via the fmgpon_loid parameter due to lack of input validation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-7384?
CVE-2019-7384 is a high-severity command injection vulnerability in n/a, published on 17 Mar 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An authenticated shell command injection issue has been discovered in Raisecom ISCOM HT803G-U, HT803G-W, HT803G-1GE, and HT803G GPON products with the firmware version ISCOMHT803G-U_2.0.0_140521_R4.1.47.002 or below. The value of the fmgpon_loid parameter is used in a system call inside the boa binary. Because there is no user input validation, this leads to authenticated code execution on the device.
Weakness: CWE-78
Which versions are affected by CVE-2019-7384?
It affects 4 products.
Products include Raisecom Iscom Ht803g-1ge Firmware, Raisecom Iscom Ht803g-U Firmware, Raisecom Iscom Ht803g-W Firmware, Raisecom Iscom Ht803g Gpon Firmware.
How do I fix CVE-2019-7384?
No fix has been published for CVE-2019-7384 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2019-7384 being exploited?
There is no known exploitation of CVE-2019-7384 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-8gwj-wx23-r7jg.