RCE in Alliedtelesis At-Rg634a
CVE-2014-1982
The administrative interface in Allied Telesis AT-RG634A ADSL Broadband router 3.3+, iMG624A firmware 3.5, iMG616LH firmware 2.4, and iMG646BD firmware 3.5 allows remote attackers to gain privileges and execute arbitrary commands via a direct request to cli.html.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.099 (95.1th percentile) — read the EPSS interpretation.
Affected products
- Alliedtelesis At-rg634a
- Alliedtelesis At-rg634a_firmware — versions 3.3\+
- Alliedtelesis Img616lh
- Alliedtelesis Img616lh_firmware — versions \+2.4
- Alliedtelesis Img624a
- Alliedtelesis Img624a_firmware — versions 3.5
- Alliedtelesis Img646bd
- Alliedtelesis Img646bd_firmware — versions 3.5
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- vultures@jpcert.or.jp (Exploit, exploit, x_refsource_EXPLOIT-DB)
- vultures@jpcert.or.jp (mailing-list, Exploit, x_refsource_FULLDISC)
Frequently asked questions
- What is CVE-2014-1982?
- CVE-2014-1982 is a vulnerability in Alliedtelesis At-Rg634a, classified under OS Command Injection. Published 2014-03-31.
- Is CVE-2014-1982 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.