A vulnerability was found in Tecno 4G Portable WiFi TR118 TR118-M30E-RR-D-EnFrArSwHaPo-OP-V008-20220830. It has been declared as critical. This vulnerability affects unknown code of the file /goform/goform_get_cmd_process of the component Ping Tool. The manipulation of the argument url leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-246130 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
References
| Link | Resource |
|---|---|
| https://vuldb.com/?id.246130 | Third Party Advisory |
| https://vuldb.com/?ctiid.246130 | Third Party Advisory |
| https://drive.google.com/file/d/1DUSlAxTbNLBdv1aLUAn-tDMu6Z1rHYH8/view | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
01 Dec 2023, 19:25
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.0 |
| CPE | cpe:2.3:h:tecno-mobile:tr118:-:*:*:*:*:*:*:* cpe:2.3:o:tecno-mobile:tr118_firmware:tr118-m30e-rr-d-enfrarswhapo-op-v008-20220830:*:*:*:*:*:*:* |
|
| First Time |
Tecno-mobile tr118 Firmware
Tecno-mobile Tecno-mobile tr118 |
|
| CWE | CWE-78 | |
| References | () https://vuldb.com/?ctiid.246130 - Third Party Advisory | |
| References | () https://vuldb.com/?id.246130 - Third Party Advisory | |
| References | () https://drive.google.com/file/d/1DUSlAxTbNLBdv1aLUAn-tDMu6Z1rHYH8/view - Exploit, Third Party Advisory |
27 Nov 2023, 01:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-11-27 01:15
Updated : 2024-05-17 02:33
NVD link : CVE-2023-6304
Mitre link : CVE-2023-6304
JSON object : View
Products Affected
tecno-mobile
- tr118
- tr118_firmware
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')