In Ericsson Network Location before 2021-07-31, it is possible for an authenticated attacker to inject commands via file_name in the export functionality. For example, a new admin user could be created.
References
| Link | Resource |
|---|---|
| https://pentest.com.tr/blog/RCE-via-Meow-Variant-along-with-an-Example-0day-PacketHackingVillage-Defcon29.html | Exploit Third Party Advisory |
| https://www.exploit-db.com/exploits/50468 | Exploit Third Party Advisory VDB Entry |
| https://www.exploit-db.com/exploits/50469 | Exploit Third Party Advisory VDB Entry |
| https://pentest.com.tr/blog/RCE-via-Meow-Variant-along-with-an-Example-0day-PacketHackingVillage-Defcon29.html | Exploit Third Party Advisory |
| https://www.exploit-db.com/exploits/50468 | Exploit Third Party Advisory VDB Entry |
| https://www.exploit-db.com/exploits/50469 | Exploit Third Party Advisory VDB Entry |
Configurations
History
21 Nov 2024, 06:29
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://pentest.com.tr/blog/RCE-via-Meow-Variant-along-with-an-Example-0day-PacketHackingVillage-Defcon29.html - Exploit, Third Party Advisory | |
| References | () https://www.exploit-db.com/exploits/50468 - Exploit, Third Party Advisory, VDB Entry | |
| References | () https://www.exploit-db.com/exploits/50469 - Exploit, Third Party Advisory, VDB Entry |
Information
Published : 2021-11-03 20:15
Updated : 2024-11-21 06:29
NVD link : CVE-2021-43339
Mitre link : CVE-2021-43339
CVE.ORG link : CVE-2021-43339
JSON object : View
Products Affected
ericsson
- network_location
CWE
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')