CVE-2023-38120 Adtran SR400ac ping Command Injection Remote Code Execution Vulnerability
Remote attackers can execute arbitrary code as root on Adtran SR400ac routers via command injection in the ping feature, even with authentication bypass.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-38120?
CVE-2023-38120 is a high-severity command injection vulnerability in Adtran SR400ac, published on 3 May 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Adtran SR400ac ping Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adtran SR400ac routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.
The specific flaw exists within the ping command, which is available over JSON-RPC. A crafted host parameter can trigger execution of a system call composed from a user-supplied string. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-20525.
Which versions are affected by CVE-2023-38120?
It affects 1 product.
Products include Adtran Sr400ac Firmware.
How do I fix CVE-2023-38120?
No fix has been published for CVE-2023-38120 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2023-38120 being exploited?
There is no known exploitation of CVE-2023-38120 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-hqqq-wpr7-6m7c.