CVE-2017-11456

2017-07-19 09:29:00 2017-07-25 19:58:02

Geneko GWR routers allow directory traversal sequences starting with a /../ substring, as demonstrated by unauthenticated read access to the configuration file.

Vector

NETWORK

Complexity

LOW

Authentication

NONE

Confidentiality

PARTIAL

Integrity

NONE

Availability

NONE

Geneko Gwr352 3g router firmware - (not an official CPE) Geneko Gwr252 edge router firmware - (not an official CPE) Geneko Gwr352wv wide voltage 3g router firmware - (not an official CPE) Geneko Gwr202 gprs router firmware - (not an official CPE)

Geneko - Gwr352 3g router firmware Geneko - Gwr252 edge router firmware Geneko - Gwr352wv wide voltage 3g router firmware Geneko - Gwr202 gprs router firmware

Advisory	Patch	Confirmed	Link
			https://blogs.securiteam.com/index.php/archives/3317#mor...

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (ID 22)

Related CAPEC 7 Relative Path Traversal (CAPEC-ID 139) Directory Traversal (CAPEC-ID 213) File System Function Injection, Content Based (CAPEC-ID 23) Using Slashes and URL Encoding Combined to Bypass Validation Logic (CAPEC-ID 64) Manipulating Input to File System Calls (CAPEC-ID 76) Using Escaped Slashes in Alternate Encoding (CAPEC-ID 78) Using Slashes in Alternate Encoding (CAPEC-ID 79)