Description (CNA)
Certain models of routers from Billion Electric has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject arbitrary system commands into a specific SSH function and execute them on the device.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Billion Electric / M100 | affected 1.04.1.592.* before 1.04.1.592.8; affected 1.04.1.613.* before 1.04.1.613.13; affected 1.04.1.* before 1.04.1.675 |
| Billion Electric / M150 | affected 1.04.1.592.* before 1.04.1.592.8; affected 1.04.1.613.* before 1.04.1.613.13; affected 1.04.1.* before 1.04.1.675 |
| Billion Electric / M120N | affected 1.04.1.592.* before 1.04.1.592.8; affected 1.04.1.613.* before 1.04.1.613.13; affected 1.04.1.* before 1.04.1.675 |
| Billion Electric / M500 | affected 1.04.1.592.* before 1.04.1.592.8; affected 1.04.1.613.* before 1.04.1.613.13; affected 1.04.1.* before 1.04.1.675 |
CWE
CWE-78
References
- https://www.twcert.org.tw/tw/cp-132-8279-bf67e-1.html
- https://www.twcert.org.tw/en/cp-139-8280-ae6e1-2.html
ADP enrichment
No English description supplied.
No references supplied.