Description
An issue was discovered on Systrome Cumilon ISG-600C, ISG-600H, and ISG-800W devices with firmware V1.1-R2.1_TRUNK-20181105.bin. A shell command injection occurs by editing the description of an ISP file. The file network/isp/isp_update_edit.php does not properly validate user input, which leads to shell command injection via the des parameter.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://packetstormsecurity.com/files/151648/SYSTORME-ISG-Command-Injection.html ↗
- http://seclists.org/fulldisclosure/2019/Feb/32 ↗
- http://www.securityfocus.com/bid/107035 ↗
- https://s3curityb3ast.github.io/KSA-Dev-003.md ↗
- https://www.breakthesec.com/2019/02/cve-2019-7383-remote-code-execution-via.html ↗