CVEvulnerability
CVE-2019-3497
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-03-21
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 9.0 HIGH — AV:N/AC:L/Au:S/C:C/I:C/A:C
- Weaknesses
- CWE-798
Description
An issue was discovered on Wifi-soft UniBox controller 0.x through 2.x devices. The tools/ping Ping feature of the Diagnostic Tools component is vulnerable to Remote Command Execution, allowing an attacker to execute arbitrary system commands on the server with root user privileges. Authentication for accessing this component can be bypassed by using Hard coded credentials.
Affected configurations
• indionetworks unibox firmware
Related
Weakness · CWE (1)
- CWE-798 Use of Hard-coded Credentials weakness
References
- http://packetstormsecurity.com/files/151077/Wifi-soft-Unibox-2.x-Remote-Command-Code-Injection.html Exploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2019/Jan/23 Exploit, Mailing List, Third Party Advisory
- https://sahildhar.github.io/blogpost/Multiple-RCE-Vulnerabilties-in-Unibox-Controller-0.x-3.x/ Exploit, Third Party Advisory
- http://packetstormsecurity.com/files/151077/Wifi-soft-Unibox-2.x-Remote-Command-Code-Injection.html Exploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2019/Jan/23 Exploit, Mailing List, Third Party Advisory
- https://sahildhar.github.io/blogpost/Multiple-RCE-Vulnerabilties-in-Unibox-Controller-0.x-3.x/ Exploit, Third Party Advisory