CVE-2017-17867

Inteno iopsys 2.0-3.14 and 4.0 devices allow remote authenticated users to execute arbitrary OS commands by modifying the leasetrigger field in the odhcpd…

published January 4, 2018

CVSS

—

EPSS

11%

Percentile

95.9

In the wild

Unconfirmed

What it is

Inteno iopsys 2.0-3.14 and 4.0 devices allow remote authenticated users to execute arbitrary OS commands by modifying the leasetrigger field in the odhcpd configuration to specify an arbitrary program, as demonstrated by a program located on an SMB share. This issue existed because the /etc/uci-defaults directory was not being used to secure the OpenWrt configuration.

The record

Technical detail

CVSS: Not scored
CVSS v4.0: Not supplied
EPSS: 0.11075 · 95.9th percentile
Published: 2018-01-04T19:00Z

EPSS history

Timeline

04 JAN 19:00Z
Inteno iopsys 2.0-3.14 and 4.0 devices allow remote authenticated users to execute arbitrary OS commands by modifying the leasetrigger field in the odhcpd…
cvelistv5