CVE-2018-19031 - OpenCVE

A command injection vulnerability exists when the authorized user passes crafted parameter to background process in the router. This affects 360 router series products (360 Safe Router P0,P1,P2,P3,P4), the affected version is V2.0.61.58897.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:L/Au:S/C:P/I:P/A:P

Vendors & Products
CPE Configurations

Vendors	Products
360	Safe Router P4 Safe Router P2 Firmware Safe Router P4 Firmware Safe Router P1 Firmware Safe Router P0 Safe Router P3 Firmware Safe Router P3 Safe Router P1 Safe Router P2 Safe Router P0 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:360:safe_router_p0_firmware:2.0.61.58897:*:*:*:*:*:*:*

cpe:2.3:h:360:safe_router_p0:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:360:safe_router_p1_firmware:2.0.61.58897:*:*:*:*:*:*:*

cpe:2.3:h:360:safe_router_p1:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:360:safe_router_p2_firmware:2.0.61.58897:*:*:*:*:*:*:*

cpe:2.3:h:360:safe_router_p2:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:360:safe_router_p3_firmware:2.0.61.58897:*:*:*:*:*:*:*

cpe:2.3:h:360:safe_router_p3:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:360:safe_router_p4_firmware:2.0.61.58897:*:*:*:*:*:*:*

cpe:2.3:h:360:safe_router_p4:-:*:*:*:*:*:*:*

References

Link	Resource
https://security.360.cn/News/news/id/188.html	Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: 360ST

Published: 2019-11-04T14:42:42

Updated: 2019-11-04T14:42:42

Reserved: 2018-11-06T00:00:00

Link: CVE-2018-19031

JSON object: View

NVD Information

Status : Analyzed

Published: 2019-11-04T15:15:11.287

Modified: 2020-08-24T17:37:01.140

Link: CVE-2018-19031

JSON object: View

Redhat Information

No data.

CWE

CWE-77

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:360:safe_router_p0_firmware:2.0.61.58897:*:*:*:*:*:*:*", "matchCriteriaId": "8EC971CA-6B4B-444F-9A14-312F4E056025", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:360:safe_router_p0:-:*:*:*:*:*:*:*", "matchCriteriaId": "35113D47-CDB8-4612-BC3E-A83A0DA95372", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:360:safe_router_p1_firmware:2.0.61.58897:*:*:*:*:*:*:*", "matchCriteriaId": "1A571AED-753F-434A-A930-AFBA375D1F40", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:360:safe_router_p1:-:*:*:*:*:*:*:*", "matchCriteriaId": "3700FDF1-53F1-4E76-87BA-92902DBCB8E1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:360:safe_router_p2_firmware:2.0.61.58897:*:*:*:*:*:*:*", "matchCriteriaId": "15B02088-2652-40BC-97DB-7AFCEF8EF6D1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:360:safe_router_p2:-:*:*:*:*:*:*:*", "matchCriteriaId": "EB8C3A6B-110D-40CF-BFFA-4B3FD66D450C", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:360:safe_router_p3_firmware:2.0.61.58897:*:*:*:*:*:*:*", "matchCriteriaId": "17AF3DAC-0C0E-441C-A77D-830705E57696", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:360:safe_router_p3:-:*:*:*:*:*:*:*", "matchCriteriaId": "937F78E0-FDE5-4068-B8B6-59C1F188AC73", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:360:safe_router_p4_firmware:2.0.61.58897:*:*:*:*:*:*:*", "matchCriteriaId": "7868460C-9A32-4BB3-9552-18D589729A96", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:360:safe_router_p4:-:*:*:*:*:*:*:*", "matchCriteriaId": "60EDE287-E3E3-43E3-BEA1-89A18624807A", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "A command injection vulnerability exists when the authorized user passes crafted parameter to background process in the router. This affects 360 router series products (360 Safe Router P0,P1,P2,P3,P4), the affected version is V2.0.61.58897."}, {"lang": "es", "value": "Se presenta una vulnerabilidad de inyecci\u00f3n de comando cuando el usuario autorizado pasa el par\u00e1metro dise\u00f1ado hacia el proceso en segundo plano en el enrutador. Esto afecta a los productos de la serie de enrutadores 360 (360 Safe Router P0, P1, P2, P3, P4), la versi\u00f3n afectada es V2.0.61.58897."}], "id": "CVE-2018-19031", "lastModified": "2020-08-24T17:37:01.140", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-11-04T15:15:11.287", "references": [{"source": "security@360.cn", "tags": ["Vendor Advisory"], "url": "https://security.360.cn/News/news/id/188.html"}], "sourceIdentifier": "security@360.cn", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}], "source": "nvd@nist.gov", "type": "Primary"}]}