Exploitation Summary
EIP tracks 2 public exploits for CVE-2019-12272. PoCs published by HACHp1, nevercodecorrect.
AI-analyzed exploit summary The repository contains functional exploit code for CVE-2019-12272, demonstrating remote command execution (RCE) in LuCI via command injection in the bandwidth_status and wireless_status endpoints. The PoC authenticates, injects a command via the URL path, and retrieves the output from a generated file.
Description
In OpenWrt LuCI through 0.10, the endpoints admin/status/realtime/bandwidth_status and admin/status/realtime/wireless_status of the web application are affected by a command injection vulnerability.
Exploits (2)
The repository contains functional exploit code for CVE-2019-12272, demonstrating remote command execution (RCE) in LuCI via command injection in the bandwidth_status and wireless_status endpoints. The PoC authenticates, injects a command via the URL path, and retrieves the output from a generated file.
The repository contains build system files for LEDE 17.01.3 but lacks any exploit code or technical details related to CVE-2019-12272. The README only mentions the CVE without providing context or PoC.
References (2)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H