Command Injection Vulnerability in Motorola Devices with Specific Firmware
CVE-2019-9117

9.8CRITICAL

Key Information:

Vendor
Motorola
Status
M2 Firmware
Vendor
CVE Published:
7 March 2019

Summary

A command injection vulnerability has been identified in Motorola C1 and M2 devices running specific firmware versions. The issue arises when the SetNetworkTomographySettings API function processes untrusted input from the request body, allowing a remote attacker to execute arbitrary operating system commands. This is facilitated through crafted HNAP1 POST requests that exploit shell metacharacters in the tomography_ping_number field, potentially granting attackers a root shell on the device.

References

https://github.com/lieanu/vuls/blob/master/motorola/M2_C1...
x_refsource_MISC

EPSS Score

9% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.