CVE-2018-0639: OS Command Injection
Published Jan 9, 2019
·Updated
Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via toolsfirmware.cgi date parameter, time parameter, and offset parameter.
Affected Software
2 affected components
NEC Aterm Hc100rc Firmware<=1.0.1
NEC Aterm Hc100rc
Event History
Jan 9, 2019
CVE Published
via MITRE·10:00 PM
Data Sourced
via MITRE·10:00 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2018-0639?
CVE-2018-0639 has been classified as a high severity vulnerability due to the potential for arbitrary command execution.
2
How do I fix CVE-2018-0639?
To fix CVE-2018-0639, update the Aterm HC100RC firmware to version 1.0.2 or higher.
3
Who is affected by CVE-2018-0639?
Users of Aterm HC100RC firmware versions 1.0.1 and earlier are affected by CVE-2018-0639.
4
What can an attacker do with CVE-2018-0639?
An attacker with administrator rights can execute arbitrary OS commands via the vulnerable parameters in the firmware.
5
Is there a workaround for CVE-2018-0639?
There is no known workaround for CVE-2018-0639 apart from upgrading the firmware.