Search
Find a vulnerability
Search criteria
5 vulnerabilities by Raisecom
CVE-2025-1536 (GCVE-0-2025-1536)
Vulnerability from nvd – Published: 2025-02-21 14:31 – Updated: 2025-02-21 16:46
VLAI
Title
Raisecom Multi-Service Intelligent Gateway Request Parameter vpn_template_style.php os command injection
Summary
A vulnerability was found in Raisecom Multi-Service Intelligent Gateway up to 20250208. It has been declared as critical. This vulnerability affects unknown code of the file /vpn/vpn_template_style.php of the component Request Parameter Handler. The manipulation of the argument stylenum leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.296476 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.296476 | signaturepermissions-required |
| https://vuldb.com/?submit.497021 | third-party-advisory |
| https://github.com/koishi0x01/CVE/blob/main/CVE_1.md | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Raisecom | Multi-Service Intelligent Gateway |
Affected:
20250208
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-1536",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-21T16:42:14.976352Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-21T16:46:38.199Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Request Parameter Handler"
],
"product": "Multi-Service Intelligent Gateway",
"vendor": "Raisecom",
"versions": [
{
"status": "affected",
"version": "20250208"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "KOISH1 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Raisecom Multi-Service Intelligent Gateway up to 20250208. It has been declared as critical. This vulnerability affects unknown code of the file /vpn/vpn_template_style.php of the component Request Parameter Handler. The manipulation of the argument stylenum leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "In Raisecom Multi-Service Intelligent Gateway bis 20250208 wurde eine Schwachstelle ausgemacht. Sie wurde als kritisch eingestuft. Das betrifft eine unbekannte Funktionalit\u00e4t der Datei /vpn/vpn_template_style.php der Komponente Request Parameter Handler. Durch Manipulation des Arguments stylenum mit unbekannten Daten kann eine os command injection-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-21T14:31:04.960Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-296476 | Raisecom Multi-Service Intelligent Gateway Request Parameter vpn_template_style.php os command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.296476"
},
{
"name": "VDB-296476 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.296476"
},
{
"name": "Submit #497021 | Raisecom Technology Co., Ltd. Raisecom Multi-Service Intelligent Gateway vpn_template_style.php Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.497021"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/koishi0x01/CVE/blob/main/CVE_1.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-02-21T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-02-21T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-02-21T08:05:16.000Z",
"value": "VulDB entry last update"
}
],
"title": "Raisecom Multi-Service Intelligent Gateway Request Parameter vpn_template_style.php os command injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-1536",
"datePublished": "2025-02-21T14:31:04.960Z",
"dateReserved": "2025-02-21T07:00:12.316Z",
"dateUpdated": "2025-02-21T16:46:38.199Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-1536 (GCVE-0-2025-1536)
Vulnerability from cvelistv5 – Published: 2025-02-21 14:31 – Updated: 2025-02-21 16:46
VLAI
Title
Raisecom Multi-Service Intelligent Gateway Request Parameter vpn_template_style.php os command injection
Summary
A vulnerability was found in Raisecom Multi-Service Intelligent Gateway up to 20250208. It has been declared as critical. This vulnerability affects unknown code of the file /vpn/vpn_template_style.php of the component Request Parameter Handler. The manipulation of the argument stylenum leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.296476 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.296476 | signaturepermissions-required |
| https://vuldb.com/?submit.497021 | third-party-advisory |
| https://github.com/koishi0x01/CVE/blob/main/CVE_1.md | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Raisecom | Multi-Service Intelligent Gateway |
Affected:
20250208
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-1536",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-21T16:42:14.976352Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-21T16:46:38.199Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Request Parameter Handler"
],
"product": "Multi-Service Intelligent Gateway",
"vendor": "Raisecom",
"versions": [
{
"status": "affected",
"version": "20250208"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "KOISH1 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Raisecom Multi-Service Intelligent Gateway up to 20250208. It has been declared as critical. This vulnerability affects unknown code of the file /vpn/vpn_template_style.php of the component Request Parameter Handler. The manipulation of the argument stylenum leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "In Raisecom Multi-Service Intelligent Gateway bis 20250208 wurde eine Schwachstelle ausgemacht. Sie wurde als kritisch eingestuft. Das betrifft eine unbekannte Funktionalit\u00e4t der Datei /vpn/vpn_template_style.php der Komponente Request Parameter Handler. Durch Manipulation des Arguments stylenum mit unbekannten Daten kann eine os command injection-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-21T14:31:04.960Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-296476 | Raisecom Multi-Service Intelligent Gateway Request Parameter vpn_template_style.php os command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.296476"
},
{
"name": "VDB-296476 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.296476"
},
{
"name": "Submit #497021 | Raisecom Technology Co., Ltd. Raisecom Multi-Service Intelligent Gateway vpn_template_style.php Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.497021"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/koishi0x01/CVE/blob/main/CVE_1.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-02-21T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-02-21T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-02-21T08:05:16.000Z",
"value": "VulDB entry last update"
}
],
"title": "Raisecom Multi-Service Intelligent Gateway Request Parameter vpn_template_style.php os command injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-1536",
"datePublished": "2025-02-21T14:31:04.960Z",
"dateReserved": "2025-02-21T07:00:12.316Z",
"dateUpdated": "2025-02-21T16:46:38.199Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
VAR-201903-0207
Vulnerability from variot - Updated: 2024-11-23 23:11An authenticated shell command injection issue has been discovered in Raisecom ISCOM HT803G-U, HT803G-W, HT803G-1GE, and HT803G GPON products with the firmware version ISCOMHT803G-U_2.0.0_140521_R4.1.47.002 or below, The values of the newpass and confpass parameters in /bin/WebMGR are used in a system call in the firmware. Because there is no user input validation, this leads to authenticated code execution on the device. plural Raisecom ISCOM The product contains a command injection vulnerability.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. Multiple Raisecom GPON Products are prone to an local command-injection vulnerability. An attacker may exploit this issue to inject and execute arbitrary commands within the context of the affected application; this may aid in further attacks. Raisecom Technology GPON-ONU HT803G-07 is a modem from China Raisecom Technology. There is a command injection vulnerability in the 'newpass' and 'confpass' parameters of /bin/WebMGR in Raisecom Technology GPON-ONU HT803G-07. An attacker could exploit this vulnerability to execute code
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201903-0207",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "iscom ht803g gpon",
"scope": "lt",
"trust": 1.0,
"vendor": "raisecom",
"version": "iscomht803g-u_2.0.0_140521_r4.1.47.002"
},
{
"model": "iscom ht803g-1ge",
"scope": "lt",
"trust": 1.0,
"vendor": "raisecom",
"version": "iscomht803g-u_2.0.0_140521_r4.1.47.002"
},
{
"model": "iscom ht803g-w",
"scope": "lt",
"trust": 1.0,
"vendor": "raisecom",
"version": "iscomht803g-u_2.0.0_140521_r4.1.47.002"
},
{
"model": "iscom ht803g-u",
"scope": "lte",
"trust": 1.0,
"vendor": "raisecom",
"version": "iscomht803g-u_2.0.0_140521_r4.1.47.002"
},
{
"model": "iscom ht803g",
"scope": null,
"trust": 0.8,
"vendor": "raisecom",
"version": null
},
{
"model": "iscom ht803g-1ge",
"scope": null,
"trust": 0.8,
"vendor": "raisecom",
"version": null
},
{
"model": "iscom ht803g-u",
"scope": null,
"trust": 0.8,
"vendor": "raisecom",
"version": null
},
{
"model": "iscom ht803g-w",
"scope": null,
"trust": 0.8,
"vendor": "raisecom",
"version": null
},
{
"model": "iscom ht803g-w gpon",
"scope": "eq",
"trust": 0.3,
"vendor": "raisecom",
"version": "0"
},
{
"model": "iscom ht803g-u gpon 2.0.0 140521 r4.1.47",
"scope": null,
"trust": 0.3,
"vendor": "raisecom",
"version": null
},
{
"model": "iscom ht803g-u gpon",
"scope": "eq",
"trust": 0.3,
"vendor": "raisecom",
"version": "0"
},
{
"model": "iscom ht803g-1ge gpon",
"scope": "eq",
"trust": 0.3,
"vendor": "raisecom",
"version": "0"
},
{
"model": "iscom ht803g gpon",
"scope": "eq",
"trust": 0.3,
"vendor": "raisecom",
"version": "0"
}
],
"sources": [
{
"db": "BID",
"id": "107030"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-003046"
},
{
"db": "NVD",
"id": "CVE-2019-7385"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:raisecom:iscom_ht803g_gpon_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:raisecom:iscom_ht803g-1ge_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:raisecom:iscom_ht803g-u_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:raisecom:iscom_ht803g-w_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-003046"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Jameel Nabbo,JameelNabbo,Kaustubh G. Padwad",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201902-619"
}
],
"trust": 0.6
},
"cve": "CVE-2019-7385",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "CVE-2019-7385",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "VHN-158820",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:L/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2019-7385",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2019-7385",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "Low",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2019-7385",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2019-7385",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-201902-619",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-158820",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-158820"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-003046"
},
{
"db": "CNNVD",
"id": "CNNVD-201902-619"
},
{
"db": "NVD",
"id": "CVE-2019-7385"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An authenticated shell command injection issue has been discovered in Raisecom ISCOM HT803G-U, HT803G-W, HT803G-1GE, and HT803G GPON products with the firmware version ISCOMHT803G-U_2.0.0_140521_R4.1.47.002 or below, The values of the newpass and confpass parameters in /bin/WebMGR are used in a system call in the firmware. Because there is no user input validation, this leads to authenticated code execution on the device. plural Raisecom ISCOM The product contains a command injection vulnerability.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. Multiple Raisecom GPON Products are prone to an local command-injection vulnerability. \nAn attacker may exploit this issue to inject and execute arbitrary commands within the context of the affected application; this may aid in further attacks. Raisecom Technology GPON-ONU HT803G-07 is a modem from China Raisecom Technology. There is a command injection vulnerability in the \u0027newpass\u0027 and \u0027confpass\u0027 parameters of /bin/WebMGR in Raisecom Technology GPON-ONU HT803G-07. An attacker could exploit this vulnerability to execute code",
"sources": [
{
"db": "NVD",
"id": "CVE-2019-7385"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-003046"
},
{
"db": "BID",
"id": "107030"
},
{
"db": "VULHUB",
"id": "VHN-158820"
}
],
"trust": 1.98
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-158820",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-158820"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2019-7385",
"trust": 2.8
},
{
"db": "PACKETSTORM",
"id": "151650",
"trust": 2.5
},
{
"db": "BID",
"id": "107030",
"trust": 2.0
},
{
"db": "JVNDB",
"id": "JVNDB-2019-003046",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201902-619",
"trust": 0.7
},
{
"db": "PACKETSTORM",
"id": "151966",
"trust": 0.7
},
{
"db": "EXPLOIT-DB",
"id": "46489",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-158820",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-158820"
},
{
"db": "BID",
"id": "107030"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-003046"
},
{
"db": "CNNVD",
"id": "CNNVD-201902-619"
},
{
"db": "NVD",
"id": "CVE-2019-7385"
}
]
},
"id": "VAR-201903-0207",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-158820"
}
],
"trust": 0.01
},
"last_update_date": "2024-11-23T23:11:55.162000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "https://www.raisecom.com/index"
},
{
"title": "Raisecom Technology GPON-ONU HT803G-07 Fixes for command injection vulnerabilities",
"trust": 0.6,
"url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=89408"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-003046"
},
{
"db": "CNNVD",
"id": "CNNVD-201902-619"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-78",
"trust": 1.1
},
{
"problemtype": "CWE-77",
"trust": 0.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-158820"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-003046"
},
{
"db": "NVD",
"id": "CVE-2019-7385"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.7,
"url": "http://packetstormsecurity.com/files/151650/raisecom-technology-gpon-onu-ht803g-07-command-injection.html"
},
{
"trust": 2.3,
"url": "http://www.securityfocus.com/bid/107030"
},
{
"trust": 2.0,
"url": "http://seclists.org/fulldisclosure/2019/feb/34"
},
{
"trust": 1.7,
"url": "http://breakthesec.com"
},
{
"trust": 1.7,
"url": "http://www.breakthesec.com/search/label/0day"
},
{
"trust": 1.7,
"url": "https://s3curityb3ast.github.io/ksa-dev-006.md"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-7385"
},
{
"trust": 1.1,
"url": "https://s3curityb3ast.github.io"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-7385"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/151966/raisecom-xpon-iscomht803g-u/2.0.0/140521/r4.1.47.002-remote-code-execution.html"
},
{
"trust": 0.6,
"url": "https://www.exploit-db.com/exploits/46489"
},
{
"trust": 0.3,
"url": "https://www.raisecom.com"
},
{
"trust": 0.3,
"url": "https://s3curityb3ast.github.io/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-158820"
},
{
"db": "BID",
"id": "107030"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-003046"
},
{
"db": "CNNVD",
"id": "CNNVD-201902-619"
},
{
"db": "NVD",
"id": "CVE-2019-7385"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-158820"
},
{
"db": "BID",
"id": "107030"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-003046"
},
{
"db": "CNNVD",
"id": "CNNVD-201902-619"
},
{
"db": "NVD",
"id": "CVE-2019-7385"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-03-21T00:00:00",
"db": "VULHUB",
"id": "VHN-158820"
},
{
"date": "2019-02-12T00:00:00",
"db": "BID",
"id": "107030"
},
{
"date": "2019-05-08T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-003046"
},
{
"date": "2019-02-13T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201902-619"
},
{
"date": "2019-03-21T16:01:11.953000",
"db": "NVD",
"id": "CVE-2019-7385"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2023-02-01T00:00:00",
"db": "VULHUB",
"id": "VHN-158820"
},
{
"date": "2019-02-12T00:00:00",
"db": "BID",
"id": "107030"
},
{
"date": "2019-05-08T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-003046"
},
{
"date": "2023-02-02T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201902-619"
},
{
"date": "2024-11-21T04:48:07.060000",
"db": "NVD",
"id": "CVE-2019-7385"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "BID",
"id": "107030"
},
{
"db": "CNNVD",
"id": "CNNVD-201902-619"
}
],
"trust": 0.9
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural Raisecom ISCOM Command injection vulnerabilities in products",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-003046"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "operating system commend injection",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201902-619"
}
],
"trust": 0.6
}
}
VAR-201903-0206
Vulnerability from variot - Updated: 2024-11-23 22:37An authenticated shell command injection issue has been discovered in Raisecom ISCOM HT803G-U, HT803G-W, HT803G-1GE, and HT803G GPON products with the firmware version ISCOMHT803G-U_2.0.0_140521_R4.1.47.002 or below. The value of the fmgpon_loid parameter is used in a system call inside the boa binary. Because there is no user input validation, this leads to authenticated code execution on the device. plural Raisecom ISCOM The product contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Multiple Raisecom GPON Products are prone to an local command-injection vulnerability. An attacker may exploit this issue to inject and execute arbitrary commands within the context of the affected application; this may aid in further attacks. Raisecom Technology GPON-ONU HT803G-07 is a modem from China Raisecom Technology. A command injection vulnerability exists in the 'fmgpon_loid' parameter in Raisecom Technology GPON-ONU HT803G-07. An attacker could exploit this vulnerability to execute code
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201903-0206",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "iscom ht803g gpon",
"scope": "lt",
"trust": 1.0,
"vendor": "raisecom",
"version": "iscomht803g-u_2.0.0_140521_r4.1.47.002"
},
{
"model": "iscom ht803g-1ge",
"scope": "lt",
"trust": 1.0,
"vendor": "raisecom",
"version": "iscomht803g-u_2.0.0_140521_r4.1.47.002"
},
{
"model": "iscom ht803g-w",
"scope": "lt",
"trust": 1.0,
"vendor": "raisecom",
"version": "iscomht803g-u_2.0.0_140521_r4.1.47.002"
},
{
"model": "iscom ht803g-u",
"scope": "lte",
"trust": 1.0,
"vendor": "raisecom",
"version": "iscomht803g-u_2.0.0_140521_r4.1.47.002"
},
{
"model": "iscom ht803g",
"scope": null,
"trust": 0.8,
"vendor": "raisecom",
"version": null
},
{
"model": "iscom ht803g-1ge",
"scope": null,
"trust": 0.8,
"vendor": "raisecom",
"version": null
},
{
"model": "iscom ht803g-u",
"scope": null,
"trust": 0.8,
"vendor": "raisecom",
"version": null
},
{
"model": "iscom ht803g-w",
"scope": null,
"trust": 0.8,
"vendor": "raisecom",
"version": null
},
{
"model": "iscom ht803g-w gpon",
"scope": "eq",
"trust": 0.3,
"vendor": "raisecom",
"version": "0"
},
{
"model": "iscom ht803g-u gpon 2.0.0 140521 r4.1.47",
"scope": null,
"trust": 0.3,
"vendor": "raisecom",
"version": null
},
{
"model": "iscom ht803g-u gpon",
"scope": "eq",
"trust": 0.3,
"vendor": "raisecom",
"version": "0"
},
{
"model": "iscom ht803g-1ge gpon",
"scope": "eq",
"trust": 0.3,
"vendor": "raisecom",
"version": "0"
},
{
"model": "iscom ht803g gpon",
"scope": "eq",
"trust": 0.3,
"vendor": "raisecom",
"version": "0"
}
],
"sources": [
{
"db": "BID",
"id": "107033"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-003047"
},
{
"db": "NVD",
"id": "CVE-2019-7384"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:raisecom:iscom_ht803g_gpon_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:raisecom:iscom_ht803g-1ge_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:raisecom:iscom_ht803g-u_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:raisecom:iscom_ht803g-w_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-003047"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Kaustubh G. Padwad",
"sources": [
{
"db": "BID",
"id": "107033"
},
{
"db": "CNNVD",
"id": "CNNVD-201902-617"
}
],
"trust": 0.9
},
"cve": "CVE-2019-7384",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "CVE-2019-7384",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.9,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "VHN-158819",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:L/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2019-7384",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2019-7384",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "Low",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2019-7384",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2019-7384",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-201902-617",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-158819",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2019-7384",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-158819"
},
{
"db": "VULMON",
"id": "CVE-2019-7384"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-003047"
},
{
"db": "CNNVD",
"id": "CNNVD-201902-617"
},
{
"db": "NVD",
"id": "CVE-2019-7384"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An authenticated shell command injection issue has been discovered in Raisecom ISCOM HT803G-U, HT803G-W, HT803G-1GE, and HT803G GPON products with the firmware version ISCOMHT803G-U_2.0.0_140521_R4.1.47.002 or below. The value of the fmgpon_loid parameter is used in a system call inside the boa binary. Because there is no user input validation, this leads to authenticated code execution on the device. plural Raisecom ISCOM The product contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Multiple Raisecom GPON Products are prone to an local command-injection vulnerability. \nAn attacker may exploit this issue to inject and execute arbitrary commands within the context of the affected application; this may aid in further attacks. Raisecom Technology GPON-ONU HT803G-07 is a modem from China Raisecom Technology. A command injection vulnerability exists in the \u0027fmgpon_loid\u0027 parameter in Raisecom Technology GPON-ONU HT803G-07. An attacker could exploit this vulnerability to execute code",
"sources": [
{
"db": "NVD",
"id": "CVE-2019-7384"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-003047"
},
{
"db": "BID",
"id": "107033"
},
{
"db": "VULHUB",
"id": "VHN-158819"
},
{
"db": "VULMON",
"id": "CVE-2019-7384"
}
],
"trust": 2.07
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-158819",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-158819"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2019-7384",
"trust": 2.9
},
{
"db": "PACKETSTORM",
"id": "151649",
"trust": 2.6
},
{
"db": "BID",
"id": "107033",
"trust": 2.1
},
{
"db": "JVNDB",
"id": "JVNDB-2019-003047",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201902-617",
"trust": 0.7
},
{
"db": "VULHUB",
"id": "VHN-158819",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2019-7384",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-158819"
},
{
"db": "VULMON",
"id": "CVE-2019-7384"
},
{
"db": "BID",
"id": "107033"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-003047"
},
{
"db": "CNNVD",
"id": "CNNVD-201902-617"
},
{
"db": "NVD",
"id": "CVE-2019-7384"
}
]
},
"id": "VAR-201903-0206",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-158819"
}
],
"trust": 0.01
},
"last_update_date": "2024-11-23T22:37:54.753000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "https://www.raisecom.com/index"
},
{
"title": "Raisecom Technology GPON-ONU HT803G-07 Fixes for command injection vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=89407"
},
{
"title": "YABWF - Yet Another Boa Webserver Fork\n\u4ee5\u4e0b\u662f\u539fBoa Webserver\u7684README\u539f\u6587\uff0c\u7528\u4e8e\u53c2\u8003",
"trust": 0.1,
"url": "https://github.com/Knighthana/YABWF "
},
{
"title": "https://github.com/s3curityb3ast/s3curityb3ast.github.io",
"trust": 0.1,
"url": "https://github.com/s3curityb3ast/s3curityb3ast.github.io "
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2019-7384"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-003047"
},
{
"db": "CNNVD",
"id": "CNNVD-201902-617"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-78",
"trust": 1.1
},
{
"problemtype": "CWE-77",
"trust": 0.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-158819"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-003047"
},
{
"db": "NVD",
"id": "CVE-2019-7384"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.8,
"url": "http://packetstormsecurity.com/files/151649/raisecom-technology-gpon-onu-ht803g-07-command-injection.html"
},
{
"trust": 3.1,
"url": "http://www.securityfocus.com/bid/107033"
},
{
"trust": 2.1,
"url": "http://seclists.org/fulldisclosure/2019/feb/33"
},
{
"trust": 1.8,
"url": "https://s3curityb3ast.github.io/ksa-dev-005.md"
},
{
"trust": 1.8,
"url": "https://www.breakthesec.com/2019/02/cve-2019-7384-authenticated-remote-code.html"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-7384"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-7384"
},
{
"trust": 0.6,
"url": "http://www.breakthesec.com"
},
{
"trust": 0.6,
"url": "http://www.breakthesec.com/search/label/0day"
},
{
"trust": 0.3,
"url": "https://www.raisecom.com"
},
{
"trust": 0.3,
"url": "https://s3curityb3ast.github.io/"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/78.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://github.com/knighthana/yabwf"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-158819"
},
{
"db": "VULMON",
"id": "CVE-2019-7384"
},
{
"db": "BID",
"id": "107033"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-003047"
},
{
"db": "CNNVD",
"id": "CNNVD-201902-617"
},
{
"db": "NVD",
"id": "CVE-2019-7384"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-158819"
},
{
"db": "VULMON",
"id": "CVE-2019-7384"
},
{
"db": "BID",
"id": "107033"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-003047"
},
{
"db": "CNNVD",
"id": "CNNVD-201902-617"
},
{
"db": "NVD",
"id": "CVE-2019-7384"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-03-21T00:00:00",
"db": "VULHUB",
"id": "VHN-158819"
},
{
"date": "2019-03-21T00:00:00",
"db": "VULMON",
"id": "CVE-2019-7384"
},
{
"date": "2019-02-12T00:00:00",
"db": "BID",
"id": "107033"
},
{
"date": "2019-05-08T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-003047"
},
{
"date": "2019-02-13T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201902-617"
},
{
"date": "2019-03-21T16:01:11.797000",
"db": "NVD",
"id": "CVE-2019-7384"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2023-02-01T00:00:00",
"db": "VULHUB",
"id": "VHN-158819"
},
{
"date": "2023-02-01T00:00:00",
"db": "VULMON",
"id": "CVE-2019-7384"
},
{
"date": "2019-02-12T00:00:00",
"db": "BID",
"id": "107033"
},
{
"date": "2019-05-08T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-003047"
},
{
"date": "2020-08-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201902-617"
},
{
"date": "2024-11-21T04:48:06.883000",
"db": "NVD",
"id": "CVE-2019-7384"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "BID",
"id": "107033"
},
{
"db": "CNNVD",
"id": "CNNVD-201902-617"
}
],
"trust": 0.9
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural Raisecom ISCOM Command injection vulnerability in the product",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-003047"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "operating system commend injection",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201902-617"
}
],
"trust": 0.6
}
}
VAR-202406-1374
Vulnerability from variot - Updated: 2024-06-27 23:08Raisecom Technology Development Co., Ltd. is a provider of optical network products and system solutions.
Raisecom iSDC of Raisecom Technology Development Co., Ltd. has a command execution vulnerability, which can be exploited by attackers to obtain server permissions.
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202406-1374",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "isdc",
"scope": null,
"trust": 0.6,
"vendor": "raisecom",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-23622"
}
]
},
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.1,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "CNVD-2024-23622",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:H/Au:S/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "CNVD",
"id": "CNVD-2024-23622",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-23622"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Raisecom Technology Development Co., Ltd. is a provider of optical network products and system solutions.\n\nRaisecom iSDC of Raisecom Technology Development Co., Ltd. has a command execution vulnerability, which can be exploited by attackers to obtain server permissions.",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-23622"
}
],
"trust": 0.6
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2024-23622",
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-23622"
}
]
},
"id": "VAR-202406-1374",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-23622"
}
],
"trust": 0.06
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-23622"
}
]
},
"last_update_date": "2024-06-27T23:08:39.478000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Patch for Raisecom iSDC of Raisecom Technology Development Co., Ltd. has a command execution vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/546506"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-23622"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2024-23622"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-06-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2024-23622"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-05-22T00:00:00",
"db": "CNVD",
"id": "CNVD-2024-23622"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Raisecom iSDC of Raisecom Technology Development Co., Ltd. has a command execution vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-23622"
}
],
"trust": 0.6
}
}