2 lines
3.2 KiB
JSON
2 lines
3.2 KiB
JSON
{"affected":[{"affectedData":[{"product":"CUJO","vendor":"n/a","versions":[{"status":"affected","version":"CUJO Smart Firewall - Firmware version 7003"}]}],"source":"talos-cna@cisco.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:getcujo:smart_firewall:7003:*:*:*:*:*:*:*","matchCriteriaId":"5447DD61-D8B9-4829-976A-A3B09FFE7974","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"An exploitable vulnerability exists in the verified boot protection of the CUJO Smart Firewall. It is possible to add arbitrary shell commands into the dhcpd.conf file, that persist across reboots and firmware updates, and thus allow for executing unverified commands. To trigger this vulnerability, a local attacker needs to be able to write into /config/dhcpd.conf."},{"lang":"es","value":"Existe una vulnerabilidad de inyección de comandos explotable en la protección de arranque verificado de CUJO Smart Firewall. Es posible agregar comandos shell arbitrarios en el archivo dhcpd.conf, que persiste a través de rearranques y actualizaciones de firmware y, por lo tanto, permite la ejecución de comandos sin verificar. Para desencadenar esta vulnerabilidad, un atacante local necesita ser capaz de escribir en /config/dhcpd.conf."}],"id":"CVE-2018-3969","lastModified":"2026-06-17T01:58:08.117","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"LOCAL","authentication":"NONE","availabilityImpact":"COMPLETE","baseScore":7.2,"confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","vectorString":"AV:L/AC:L/Au:N/C:C/I:C/A:C","version":"2.0"},"exploitabilityScore":3.9,"impactScore":10.0,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":false}],"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.5,"impactScore":6.0,"source":"talos-cna@cisco.com","type":"Secondary"}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2019-03-21T16:29:01.597","references":[{"source":"talos-cna@cisco.com","tags":["Exploit","Third Party Advisory"],"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2018-0634"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2018-0634"}],"sourceIdentifier":"talos-cna@cisco.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"nvd@nist.gov","type":"Primary"}]}
|