Vulnerability Description
The installer for the Alcatel OSPREY3_MINI Modem component on EE EE40VB 4G mobile broadband modems with firmware before EE40_00_02.00_45 sets weak permissions (Everyone:Full Control) for the "Web Connecton\EE40" and "Web Connecton\EE40\BackgroundService" directories, which allows local users to gain privileges, as demonstrated by inserting a Trojan horse ServiceManager.exe file into the "Web Connecton\EE40\BackgroundService" directory.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ee | Ee40Vb Firmware | < ee40_00_02.00_45 |
| Ee | Ee40Vb | - |
Related Weaknesses (CWE)
References
- http://blog.zerodaylab.com/2018/09/zerodaylab-discovers-ee-unquoted.htmlExploitPatch
- http://packetstormsecurity.com/files/149492/EE-4GEE-Mini-Local-Privilege-EscalatExploitThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/105385Third Party AdvisoryVDB Entry
- https://osandamalith.com/2018/09/17/ee-4gee-mini-local-privilege-escalation-vulnExploitPatchTechnical Description
- https://www.exploit-db.com/exploits/45501/ExploitThird Party AdvisoryVDB Entry
- http://blog.zerodaylab.com/2018/09/zerodaylab-discovers-ee-unquoted.htmlExploitPatch
- http://packetstormsecurity.com/files/149492/EE-4GEE-Mini-Local-Privilege-EscalatExploitThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/105385Third Party AdvisoryVDB Entry
- https://osandamalith.com/2018/09/17/ee-4gee-mini-local-privilege-escalation-vulnExploitPatchTechnical Description
- https://www.exploit-db.com/exploits/45501/ExploitThird Party AdvisoryVDB Entry
FAQ
What is CVE-2018-14327?
CVE-2018-14327 is a vulnerability with a CVSS score of 7.8 (HIGH). The installer for the Alcatel OSPREY3_MINI Modem component on EE EE40VB 4G mobile broadband modems with firmware before EE40_00_02.00_45 sets weak permissions (Everyone:Full Control) for the "Web Conn...
How severe is CVE-2018-14327?
CVE-2018-14327 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-14327?
Check the references section above for vendor advisories and patch information. Affected products include: Ee Ee40Vb Firmware, Ee Ee40Vb.