Skip to content
CVE PROGRAM SOURCE RECORD6.8 Medium

CVE-2023-43477

Post-Auth Command Injection in Telstra Smart Modem Gen 2 (Arcadyan LH1000)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
tenable

Description

The ping_from parameter of ping_tracerte.cgi in the web UI of Telstra Smart Modem Gen 2 (Arcadyan LH1000), firmware versions < 0.18.15r, was not properly sanitized before being used in a system call, which could allow an authenticated attacker to achieve command injection as root on the device. 

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Telstra Smart Modem Gen 2 (Arcadyan LH1000)

Default version status: unaffected

  • 0 to < 0.18.15raffected

References