0x4 CVE-2018-13861
Discoverer
VULNC0D3 ( @herwonowr )
CVE ID
Description
Touchpad / Trivum WebTouch Setup V9 V2.53 build 13163 of Apr 6 2018 09:10:14 (FW 303), allows unauthorized remote attackers to reboot or execute other functions via “/xml/system/control.xml” URL, using GET request to the end-point “?action=reboot” for example.
Vulnerability Type
Code Execution
Vendor of Product
Trivum
– Vendor Homepage : http://trivum.com
– Software Link : https://world.trivum-shop.de
Affected Product Code Base
V2.53 build 13163 of Apr 6 2018 09:10:14 (FW 303)
Affected Component
System control
Attack Type
Remote
Impact Code execution
True
Attack Vectors
Remote
Timeline
– 2018-07-10 : Request CVE ID
– 2018-07-11 : CVE ID Assigned
– 2018-07-11 : Contacting Vendor
– 2018-07-12 : Vendor Respond
Vendor fix the issue:
“Restart capabilities are highly important for customers, to get the system to a defined starting point in case of problems. So far no customer reported unwanted restarts, and we fear to render the system unusable if we restrict too much.”
– 2018-07-14 : Request for Publication
– 2018-07-18 : CVE ID Public Release