OSVDB ID: 86154

Title: BigPond Wireless Broadband Gateway 3G21WB ping.cgi Crafted HTTP Request Parsing Remote Shell Command Execution

Info

Disclosure

Oct 11, 2012

Discovery

Unknown

Dates

Exploit

Oct 11, 2012

Solution

Unknown

Description

BigPond Wireless Broadband Gateway 3G21WB contains a flaw that is triggered when the ping.cgi script fails to properly validate certain input during the parsing of a specially crafted HTTP request. This may allow a remote attacker to execute arbitrary shell commands.

Classification

Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Solution Unknown
Exploit: Exploit Public
Disclosure: No Vendor Response

Solution

OSVDB is not aware of a solution for this vulnerability.

Products

NetComm Limited

BigPond Elite Wireless Broadband Gateway 3G21WB

Unspecified

References

Exploit Database: 21992
Secunia Advisory ID: 50951
Related OSVDB ID: 86153
Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2012-10/0072.html
Vendor URL: http://www.netcommwireless.com/product/3g/3g21wb

Credit

Unknown or Incomplete

Direct URL: http://osvdb.org/86154