CVE-2019-6962: OS Command Injection
A shell injection issue in cosawifiapis.c in the RDK RDKB-20181217-1 CcspWifiAgent module allows attackers with login credentials to execute arbitrary shell commands under the CcspWifiSsp process (running as root) if the platform was compiled with the ENABLEFEATUREMESHWIFI macro. The attack is conducted by changing the Wi-Fi network password to include crafted escape characters. This is related to the WebUI module.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-6962?
CVE-2019-6962 is a shell injection issue in the CcspWifiAgent module in RDK RDKB-20181217-1 that allows attackers with login credentials to execute arbitrary shell commands.
How severe is CVE-2019-6962?
CVE-2019-6962 has a severity rating of 7.5 (high).
How does CVE-2019-6962 work?
CVE-2019-6962 allows attackers with login credentials to inject and execute arbitrary shell commands under the CcspWifiSsp process (running as root) in the RDKB-20181217-1 platform.
Which software versions are affected by CVE-2019-6962?
CVE-2019-6962 affects RDKB-20181217-1.
How can CVE-2019-6962 be fixed?
To fix CVE-2019-6962, it is recommended to update the affected software version to a version that addresses the shell injection issue.