Vulnerability-Lookup

CNVD-2017-08179

Vulnerability from cnvd - Published: 2017-06-05

Title

Mimosa Client Radios和Mimosa Backhaul Radios拒绝服务漏洞

Description

Mimosa Client Radios和Mimosa Backhaul Radios都是美国Mimosa Networks公司的产品。Mimosa Client Radios是一个Mimosa多点解决方案的客户端设备的管理程序。Mimosa Backhaul Radios是一个宽带回程设备的管理程序。 Mimosa Client Radios 2.2.3之前的版本和Mimosa Backhaul Radios 2.2.3之前的版本中存在拒绝服务漏洞。远程攻击者可利用该漏洞执行命令，实施拒绝服务攻击。

Severity

中

Patch Name

Mimosa Client Radios和Mimosa Backhaul Radios拒绝服务漏洞的补丁

Patch Description

Formal description

目前厂商已经发布了升级补丁以修复此安全问题，详情请关注厂商主页： http://www.mimosa.co/

Reference

http://blog.iancaling.com/post/160596244178

Impacted products

Name
['Mimosa Networks Mimosa Backhaul Radios <2.2.3', 'Mimosa Networks Mimosa Client Radios <2.2.3']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-9131"
    }
  },
  "description": "Mimosa Client Radios\u548cMimosa Backhaul Radios\u90fd\u662f\u7f8e\u56fdMimosa Networks\u516c\u53f8\u7684\u4ea7\u54c1\u3002Mimosa Client Radios\u662f\u4e00\u4e2aMimosa\u591a\u70b9\u89e3\u51b3\u65b9\u6848\u7684\u5ba2\u6237\u7aef\u8bbe\u5907\u7684\u7ba1\u7406\u7a0b\u5e8f\u3002Mimosa Backhaul Radios\u662f\u4e00\u4e2a\u5bbd\u5e26\u56de\u7a0b\u8bbe\u5907\u7684\u7ba1\u7406\u7a0b\u5e8f\u3002\r\n\r\nMimosa Client Radios 2.2.3\u4e4b\u524d\u7684\u7248\u672c\u548cMimosa Backhaul Radios 2.2.3\u4e4b\u524d\u7684\u7248\u672c\u4e2d\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6267\u884c\u547d\u4ee4\uff0c\u5b9e\u65bd\u62d2\u7edd\u670d\u52a1\u653b\u51fb\u3002",
  "discovererName": "Unknown",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u8be6\u60c5\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\uff1a\r\nhttp://www.mimosa.co/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-08179",
  "openTime": "2017-06-05",
  "patchDescription": "Mimosa Client Radios\u548cMimosa Backhaul Radios\u90fd\u662f\u7f8e\u56fdMimosa Networks\u516c\u53f8\u7684\u4ea7\u54c1\u3002Mimosa Client Radios\u662f\u4e00\u4e2aMimosa\u591a\u70b9\u89e3\u51b3\u65b9\u6848\u7684\u5ba2\u6237\u7aef\u8bbe\u5907\u7684\u7ba1\u7406\u7a0b\u5e8f\u3002Mimosa Backhaul Radios\u662f\u4e00\u4e2a\u5bbd\u5e26\u56de\u7a0b\u8bbe\u5907\u7684\u7ba1\u7406\u7a0b\u5e8f\u3002\r\n\r\nMimosa Client Radios 2.2.3\u4e4b\u524d\u7684\u7248\u672c\u548cMimosa Backhaul Radios 2.2.3\u4e4b\u524d\u7684\u7248\u672c\u4e2d\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6267\u884c\u547d\u4ee4\uff0c\u5b9e\u65bd\u62d2\u7edd\u670d\u52a1\u653b\u51fb\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Mimosa Client Radios\u548cMimosa Backhaul Radios\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Mimosa Networks Mimosa Backhaul Radios \u003c2.2.3",
      "Mimosa Networks Mimosa Client Radios \u003c2.2.3"
    ]
  },
  "referenceLink": "http://blog.iancaling.com/post/160596244178",
  "serverity": "\u4e2d",
  "submitTime": "2017-05-23",
  "title": "Mimosa Client Radios\u548cMimosa Backhaul Radios\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e"
}

CVE-2017-9131 (GCVE-0-2017-9131)

Vulnerability from cvelistv5 – Published: 2017-05-21 21:00 – Updated: 2024-08-05 16:55

Summary

An issue was discovered on Mimosa Client Radios before 2.2.3 and Mimosa Backhaul Radios before 2.2.3. By connecting to the Mosquitto broker on an access point and one of its clients, an attacker can gather enough information to craft a command that reboots the client remotely when sent to the client's Mosquitto broker, aka "unauthenticated remote command execution." This command can be re-sent endlessly to act as a DoS attack on the client.

Severity

No CVSS data available.

CWE

Assigner

mitre

References

1 reference

URL	Tags
http://blog.iancaling.com/post/160596244178	x_refsource_MISC

Date Public

2017-05-21 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T16:55:22.378Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://blog.iancaling.com/post/160596244178"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-05-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered on Mimosa Client Radios before 2.2.3 and Mimosa Backhaul Radios before 2.2.3. By connecting to the Mosquitto broker on an access point and one of its clients, an attacker can gather enough information to craft a command that reboots the client remotely when sent to the client\u0027s Mosquitto broker, aka \"unauthenticated remote command execution.\" This command can be re-sent endlessly to act as a DoS attack on the client."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-05-21T21:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://blog.iancaling.com/post/160596244178"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-9131",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An issue was discovered on Mimosa Client Radios before 2.2.3 and Mimosa Backhaul Radios before 2.2.3. By connecting to the Mosquitto broker on an access point and one of its clients, an attacker can gather enough information to craft a command that reboots the client remotely when sent to the client\u0027s Mosquitto broker, aka \"unauthenticated remote command execution.\" This command can be re-sent endlessly to act as a DoS attack on the client."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://blog.iancaling.com/post/160596244178",
              "refsource": "MISC",
              "url": "http://blog.iancaling.com/post/160596244178"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-9131",
    "datePublished": "2017-05-21T21:00:00.000Z",
    "dateReserved": "2017-05-21T00:00:00.000Z",
    "dateUpdated": "2024-08-05T16:55:22.378Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2017-08179

CVE-2017-9131 (GCVE-0-2017-9131)

Tags

Sightings

Nomenclature