Vulnerability Description
An issue was discovered on certain ABUS TVIP devices. Due to a path traversal in /opt/cgi/admin/filewrite, an attacker can write to files, and thus execute code arbitrarily with root privileges.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Abus | Tvip 10000 Firmware | - |
| Abus | Tvip 10000 | - |
| Abus | Tvip 10001 Firmware | - |
| Abus | Tvip 10001 | - |
| Abus | Tvip 10005 Firmware | - |
| Abus | Tvip 10005 | - |
| Abus | Tvip 10005A Firmware | - |
| Abus | Tvip 10005A | - |
| Abus | Tvip 10005B Firmware | - |
| Abus | Tvip 10005B | - |
| Abus | Tvip 10050 Firmware | - |
| Abus | Tvip 10050 | - |
| Abus | Tvip 10051 Firmware | - |
| Abus | Tvip 10051 | - |
| Abus | Tvip 10055A Firmware | - |
| Abus | Tvip 10055A | - |
| Abus | Tvip 10055B Firmware | - |
| Abus | Tvip 10055B | - |
| Abus | Tvip 10500 Firmware | - |
| Abus | Tvip 10500 | - |
Related Weaknesses (CWE)
References
- https://sec.maride.cc/posts/abus/ExploitThird Party Advisory
- https://www.ccc.de/en/updates/2019/update-nicht-verfugbar-hersteller-nicht-zu-erThird Party Advisory
- https://sec.maride.cc/posts/abus/ExploitThird Party Advisory
- https://www.ccc.de/en/updates/2019/update-nicht-verfugbar-hersteller-nicht-zu-erThird Party Advisory
FAQ
What is CVE-2018-16739?
CVE-2018-16739 is a vulnerability with a CVSS score of 8.8 (HIGH). An issue was discovered on certain ABUS TVIP devices. Due to a path traversal in /opt/cgi/admin/filewrite, an attacker can write to files, and thus execute code arbitrarily with root privileges.
How severe is CVE-2018-16739?
CVE-2018-16739 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-16739?
Check the references section above for vendor advisories and patch information. Affected products include: Abus Tvip 10000 Firmware, Abus Tvip 10000, Abus Tvip 10001 Firmware, Abus Tvip 10001, Abus Tvip 10005 Firmware.