CVE-2023-35193

CVSS V2 None CVSS V3 None
Description
An OS command injection vulnerability exists in the api.cgi cmd.mvpn.x509.write functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP request can lead to command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.This vulnerability is specifically for the `system` call in the file `/web/MANGA/cgi-bin/api.cgi` for firmware version 6.3.5 at offset 0x4bddb8.
Overview
  • CVE ID
  • CVE-2023-35193
  • Assigner
  • talos
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2023-10-11T15:16:55.642Z
  • Last Modified Date
  • 2023-10-11T17:00:09.009Z
History
Created Old Value New Value Data Type Notes
2024-06-25 19:32:52 Added to TrackCVE