Cypress Solutions CTM-200 2.7.1 Root Remote OS Command Injection
Posted by deepcore on October 12, 2021 – 6:27 pm
Cypress Solutions CTM-200 wireless gateway version 2.7.1 suffers from an authenticated semi-blind OS command injection vulnerability. This can be exploited to inject and execute arbitrary shell commands as the root user through the ‘ctm-config-upgrade.sh’ script leveraging the ‘fw_url’ POST parameter used in the cmd upgreadefw as argument, called by ctmsys() as pointer to execv() and make_wget_url() function to the wget command in /usr/bin/cmdmain ELF binary.
Post a reply
You must be logged in to post a comment.