CVE-2023-35194

CVSS V2 None CVSS V3 None
Description
An OS command injection vulnerability exists in the api.cgi cmd.mvpn.x509.write functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP request can lead to command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.This vulnerability is specifically for the `system` call in the file `/web/MANGA/cgi-bin/api.cgi` for firmware version 6.3.5 at offset `0x4bde44`.
Overview
  • CVE ID
  • CVE-2023-35194
  • Assigner
  • talos
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2023-10-11T15:16:55.771Z
  • Last Modified Date
  • 2023-10-11T17:00:09.136Z
History
Created Old Value New Value Data Type Notes
2024-06-25 20:04:33 Added to TrackCVE