CVE-2020-27542

Rostelecom CS-C2SHW 5.0.082.1 is affected by: Bash command injection

published January 25, 2021

CVSS
—
EPSS
1%
Percentile
67.6
In the wild
Unconfirmed
What it is

Rostelecom CS-C2SHW 5.0.082.1 is affected by: Bash command injection. The camera reads configuration from QR code (including network settings). The static IP configuration from QR code is copied to the file /config/ip-static and after reboot data from this file is inserted into bash command (without any escaping). So bash injection is possible. Camera doesn't parse QR codes if it's already successfully configured. Camera is always rebooted after successful configuration via QR code.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01183 · 67.6th percentile
Published
2021-01-25T20:37Z
EPSS history
Timeline
  • 25 JAN 20:37Z
    Rostelecom CS-C2SHW 5.0.082.1 is affected by: Bash command injection
    cvelistv5