CVE-2019-25483 - Vulnerability Analysis

Overview

Comtrend AR-5310 GE31-412SSG-C01_R10.A2pG039u.d24k contains a command injection caused by improper sanitization of command substitution operator $( ) in allowed commands, letting local attackers execute arbitrary shell commands.

Severity & Score

Impact

Local attackers can execute arbitrary shell commands, leading to full system compromise.

Mitigation

Update to the latest firmware version that patches this vulnerability.

References

• https://www.exploit-db.com/exploits/47149
• https://www.vulncheck.com/advisories/comtrend-ar-ge-ssg-c-rapgudk-restricted-shell-escape
• https://www.vulncheck.com/advisories/comtrend-ar-5310-ge31-412ssg-c01-r10-a2pg039u-d24k-restricted-shell-escape

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner