Guest User

Untitled

a guest
Jul 29th, 2025
673
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 1.21 KB | None | 0 0
  1. # CVE-2025-50475: OS command injection vulnerability in Russound MBX-PRE-D67F firmware version 3.1.6
  2.  
  3. ## Description
  4. An OS command injection vulnerability exists in Russound MBX-PRE-D67F firmware version 3.1.6, allowing unauthenticated attackers to execute arbitrary commands as root via crafted input to the query parameter in network configuration requests. This vulnerability stems from improper neutralization of special elements used in an OS command within the network configuration handler, enabling remote code execution with the highest privileges.
  5.  
  6. ## Vendor
  7. Russound
  8.  
  9. ## Affected Product
  10. - Model: Russound MBX-PRE-D67F
  11. - Firmware Version: 3.1.6
  12.  
  13. ## Affected Component
  14. `/rvServer.fcgi`
  15.  
  16. ## Vulnerability Type
  17. OS Command Injection
  18.  
  19. ## Attack Type
  20. Remote
  21.  
  22. ## Impact
  23. Allows unauthenticated attackers to execute arbitrary commands as root via crafted input to the hostname parameter in network configuration requests.
  24.  
  25. ## Attack Vectors
  26. The vulnerability can be exploited by sending a specially crafted HTTP request to the device's network configuration interface with malicious commands injected in the query parameter. No authentication is required to perform this attack.
  27.  
  28. ## Discoverer
  29. Yazeed Alewah
Add Comment
Please, Sign In to add comment