CVE-2019-9117: OS Command Injection
An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetNetworkTomographySettings API function, as demonstrated by shell metacharacters in the tomographypingnumber field.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-9117?
CVE-2019-9117 is a Command Injection vulnerability discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively, allowing a remote attacker to execute arbitrary code and obtain a root shell.
How severe is CVE-2019-9117?
CVE-2019-9117 is classified as critical with a severity value of 9.8.
How does CVE-2019-9117 impact Motorola C1 and M2 devices?
CVE-2019-9117 allows a remote attacker to execute arbitrary OS commands on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively, potentially granting them unauthorized access and control.
What is a Command Injection vulnerability?
A Command Injection vulnerability is a type of security flaw that allows attackers to execute arbitrary commands on a target system, often leading to unauthorized access or control.
Is there a fix for CVE-2019-9117?
To fix CVE-2019-9117, Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively should apply the latest firmware updates provided by Motorola to address the Command Injection vulnerability.