CVE-2019-9974
First published: Thu Apr 11 2019(Updated: )
diag_tool.cgi on DASAN H660RM GPON routers with firmware 1.03-0022 lacks any authorization check, which allows remote attackers to run a ping command via a GET request to enumerate LAN devices or crash the router with a DoS attack.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Dasannetworks H660rm Firmware | =1.03-0022 | |
| Dasannetworks H660rm | ||
| All of | ||
| Dasannetworks H660rm Firmware | =1.03-0022 | |
| Dasannetworks H660rm |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/152232/DASAN-H660RM-Information-Disclosure-Hardcoded-Key.html
- https://blog.burghardt.pl/2019/03/diag_tool-cgi-on-dasan-h660rm-devices-with-firmware-1-03-0022-allows-spawning-ping-processes-without-any-authorization-leading-to-information-disclosure-and-dos-attacks/
- https://seclists.org/bugtraq/2019/Mar/41
Frequently Asked Questions
What is the severity of CVE-2019-9974?
CVE-2019-9974 is considered a medium severity vulnerability due to the lack of authorization checks, allowing remote command execution.
How do I fix CVE-2019-9974?
To fix CVE-2019-9974, you should upgrade the firmware of your DASAN H660RM router to a version that includes security patches.
What types of attacks can be executed using CVE-2019-9974?
CVE-2019-9974 can be exploited to execute ping commands to enumerate LAN devices or perform denial of service attacks that may crash the router.
Which firmware version is affected by CVE-2019-9974?
CVE-2019-9974 specifically affects DASAN H660RM routers running firmware version 1.03-0022.
Who can exploit CVE-2019-9974?
CVE-2019-9974 can be exploited by remote attackers without authentication, making it accessible to anyone on the network.
- collector/nvd-index
- agent/weakness
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/references
- agent/first-publish-date
- agent/description
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/author
- agent/event
- agent/softwarecombine
- agent/tags
- agent/source
- vendor/dasannetworks
- canonical/dasannetworks h660rm firmware
- version/dasannetworks h660rm firmware/1.03-0022
- canonical/dasannetworks h660rm