CVE-2017-9807 An issue was discovered in the OpenWebif plugin through 1.2.4 for E2 open devices. The saveConfig function of "plugin/controllers/models/config.py" performs an eval() call on the contents of the "key"...
CriticalCVSS 9.8
EPSS 4.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue was discovered in the OpenWebif plugin through 1.2.4 for E2 open devices. The saveConfig function of "plugin/controllers/models/config.py" performs an eval() call on the contents of the "key" HTTP GET parameter. This allows an unauthenticated remote attacker to execute arbitrary Python code or OS commands via api/saveconfig.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openwebif project openwebif | <= 1.2.4 | No fix listed |
References
- [oss-security] 20171002 CVE-2017-9807: e2openplugin-OpenWebif: Remote code execution through HTTP GET parameter manipulation mailing-list
- 99232 third-party-advisory vdb-entry
- census-labs.com
- github.com exploit issue-tracking third-party-advisory