Search
Find a vulnerability
Search criteria
2 vulnerabilities found for 4g_portable_wifi_tr118_firmware by tecno-mobile
CVE-2024-10195 (GCVE-0-2024-10195)
Vulnerability from nvd – Published: 2024-10-20 08:31 – Updated: 2024-10-21 19:28
VLAI
Title
Tecno 4G Portable WiFi TR118 SMS Check goform_get_cmd_process sql injection
Summary
A vulnerability was found in Tecno 4G Portable WiFi TR118 V008-20220830. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /goform/goform_get_cmd_process of the component SMS Check. The manipulation of the argument order_by leads to sql injection. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
4.7 (Medium)
4.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-89 - SQL Injection
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.280969 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.280969 | signaturepermissions-required |
| https://vuldb.com/?submit.422994 | third-party-advisory |
| https://asciinema.org/a/2mwkmDqRZfeAYTu5hHre1r4QB | related |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Tecno | 4G Portable WiFi TR118 |
Affected:
V008-20220830
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-10195",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-21T19:28:18.889431Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-21T19:28:34.492Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"SMS Check"
],
"product": "4G Portable WiFi TR118",
"vendor": "Tecno",
"versions": [
{
"status": "affected",
"version": "V008-20220830"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Allan Njuguna (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Tecno 4G Portable WiFi TR118 V008-20220830. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /goform/goform_get_cmd_process of the component SMS Check. The manipulation of the argument order_by leads to sql injection. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "In Tecno 4G Portable WiFi TR118 V008-20220830 wurde eine kritische Schwachstelle ausgemacht. Hierbei betrifft es unbekannten Programmcode der Datei /goform/goform_get_cmd_process der Komponente SMS Check. Durch das Manipulieren des Arguments order_by mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff \u00fcber das Netzwerk."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.8,
"vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-20T08:31:03.986Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-280969 | Tecno 4G Portable WiFi TR118 SMS Check goform_get_cmd_process sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.280969"
},
{
"name": "VDB-280969 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.280969"
},
{
"name": "Submit #422994 | Tecno 4G Portable WiFi TR118 firmware version(TR118-M30E-RR-D- EnFrArSwHaPo-OP-V008-20220830) SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.422994"
},
{
"tags": [
"related"
],
"url": "https://asciinema.org/a/2mwkmDqRZfeAYTu5hHre1r4QB"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-10-19T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2024-10-19T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2024-10-19T16:32:37.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tecno 4G Portable WiFi TR118 SMS Check goform_get_cmd_process sql injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2024-10195",
"datePublished": "2024-10-20T08:31:03.986Z",
"dateReserved": "2024-10-19T14:27:14.961Z",
"dateUpdated": "2024-10-21T19:28:34.492Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-10195 (GCVE-0-2024-10195)
Vulnerability from cvelistv5 – Published: 2024-10-20 08:31 – Updated: 2024-10-21 19:28
VLAI
Title
Tecno 4G Portable WiFi TR118 SMS Check goform_get_cmd_process sql injection
Summary
A vulnerability was found in Tecno 4G Portable WiFi TR118 V008-20220830. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /goform/goform_get_cmd_process of the component SMS Check. The manipulation of the argument order_by leads to sql injection. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
4.7 (Medium)
4.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-89 - SQL Injection
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.280969 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.280969 | signaturepermissions-required |
| https://vuldb.com/?submit.422994 | third-party-advisory |
| https://asciinema.org/a/2mwkmDqRZfeAYTu5hHre1r4QB | related |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Tecno | 4G Portable WiFi TR118 |
Affected:
V008-20220830
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-10195",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-21T19:28:18.889431Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-21T19:28:34.492Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"SMS Check"
],
"product": "4G Portable WiFi TR118",
"vendor": "Tecno",
"versions": [
{
"status": "affected",
"version": "V008-20220830"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Allan Njuguna (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Tecno 4G Portable WiFi TR118 V008-20220830. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /goform/goform_get_cmd_process of the component SMS Check. The manipulation of the argument order_by leads to sql injection. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "In Tecno 4G Portable WiFi TR118 V008-20220830 wurde eine kritische Schwachstelle ausgemacht. Hierbei betrifft es unbekannten Programmcode der Datei /goform/goform_get_cmd_process der Komponente SMS Check. Durch das Manipulieren des Arguments order_by mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff \u00fcber das Netzwerk."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.8,
"vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-20T08:31:03.986Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-280969 | Tecno 4G Portable WiFi TR118 SMS Check goform_get_cmd_process sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.280969"
},
{
"name": "VDB-280969 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.280969"
},
{
"name": "Submit #422994 | Tecno 4G Portable WiFi TR118 firmware version(TR118-M30E-RR-D- EnFrArSwHaPo-OP-V008-20220830) SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.422994"
},
{
"tags": [
"related"
],
"url": "https://asciinema.org/a/2mwkmDqRZfeAYTu5hHre1r4QB"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-10-19T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2024-10-19T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2024-10-19T16:32:37.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tecno 4G Portable WiFi TR118 SMS Check goform_get_cmd_process sql injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2024-10195",
"datePublished": "2024-10-20T08:31:03.986Z",
"dateReserved": "2024-10-19T14:27:14.961Z",
"dateUpdated": "2024-10-21T19:28:34.492Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}