{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2017-07-17T00:00:00", "descriptions": [{"lang": "en", "value": "Inteno routers have a JUCI ACL misconfiguration that allows the \"user\" account to read files, write to files, and add root SSH keys via JSON commands to ubus. (Exploitation is sometimes easy because the \"user\" password might be \"user\" or might match the Wi-Fi key.)"}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-07-17T15:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://neonsea.uk/blog/2017/07/17/cve-2017-11361.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2017-11361", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Inteno routers have a JUCI ACL misconfiguration that allows the \"user\" account to read files, write to files, and add root SSH keys via JSON commands to ubus. (Exploitation is sometimes easy because the \"user\" password might be \"user\" or might match the Wi-Fi key.)"}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://neonsea.uk/blog/2017/07/17/cve-2017-11361.html", "refsource": "MISC", "url": "https://neonsea.uk/blog/2017/07/17/cve-2017-11361.html"}]}}}}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2017-11361", "datePublished": "2017-07-17T16:00:00", "dateReserved": "2017-07-16T00:00:00", "dateUpdated": "2017-07-17T15:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:intenogroup:inteno_router_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "DC291C7C-0D3F-4D00-A8C9-7B0A437FCA2A", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:intenogroup:inteno_router:-:*:*:*:*:*:*:*", "matchCriteriaId": "A62DBDCB-B236-427F-A1E4-C44C8D7296C6", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Inteno routers have a JUCI ACL misconfiguration that allows the \"user\" account to read files, write to files, and add root SSH keys via JSON commands to ubus. (Exploitation is sometimes easy because the \"user\" password might be \"user\" or might match the Wi-Fi key.)"}, {"lang": "es", "value": "Los enrutadores Inteno tienen una configuraci\u00f3n inapropiada de la ACL JUCI, que permite a la cuenta \"user\" leer archivos, escribir en archivos y agregar claves SSH root por medio de comandos JSON en ubus. (La explotaci\u00f3n algunas veces es f\u00e1cil porque la contrase\u00f1a de \"user\" puede ser \"user\" o puede coincidir con la clave de Wi-Fi)."}], "id": "CVE-2017-11361", "lastModified": "2019-10-03T00:03:26.223", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "COMPLETE", "baseScore": 9.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 10.0, "obtainAllPrivilege": true, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-07-17T17:29:00.493", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://neonsea.uk/blog/2017/07/17/cve-2017-11361.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}