CVE-2019-25483
HIGHComtrend AR-5310 GE31-412SSG-C01_R10.A2pG039u.d24k - Command Injection
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2019-25483. PoCs published by AMRI Amine.
AI-analyzed exploit summary This exploit demonstrates a local shell escape vulnerability in Comtrend AR-5310 routers by leveraging the unfiltered command substitution operator $(command) to bypass the restricted shell and execute arbitrary commands.
Description
Comtrend AR-5310 GE31-412SSG-C01_R10.A2pG039u.d24k contains a restricted shell escape vulnerability that allows local users to bypass command restrictions by using the command substitution operator $( ). Attackers can inject arbitrary commands through the $( ) syntax when passed as arguments to allowed commands like ping to execute unrestricted shell access.
Exploits (1)
This exploit demonstrates a local shell escape vulnerability in Comtrend AR-5310 routers by leveraging the unfiltered command substitution operator $(command) to bypass the restricted shell and execute arbitrary commands.
References (2)
Scores
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H