Recent Vulnerabilities Research Posts Trends Blog About Contact

Published: 22/06/2017 Updated: 13/10/2017

CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 890

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

An issue exists in the OpenWebif plugin up to and including 1.2.4 for E2 open devices. The saveConfig function of "plugin/controllers/models/config.py" performs an eval() call on the contents of the "key" HTTP GET parameter. This allows an unauthenticated remote malicious user to execute arbitrary Python code or OS commands via api/saveconfig.

Vulnerable Product	Search on Vulmon	Subscribe to Product
openwebif project openwebif

e2openplugin OpenWebif versions 029 through 124 suffer from a code execution vulnerability ...

CWE-94 https://github.com/E2OpenPlugins/e2openplugin-OpenWebif/issues/620 http://www.securityfocus.com/bid/99232 https://census-labs.com/news/2017/10/02/e2openplugin-openwebif-saveconfig-remote-code-execution/http://www.openwall.com/lists/oss-security/2017/10/02/4 https://nvd.nist.gov https://packetstormsecurity.com/files/144493/e2openplugin-OpenWebif-1.2.4-Code-Execution.html

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2017-9807

Vulnerability Summary

Vulnerability Trend

Exploits

References

Vulmon Search

About

Products

Connect