What is CVE-2017-9135?

CVE-2017-9135 is a high-severity vulnerability in Mimosa Backhaul Radios, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 8.8/10. Published 2017-05-21.

How severe is CVE-2017-9135?

High severity. CVSS v3 base score is 8.8 out of 10.

Is CVE-2017-9135 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Mimosa Backhaul Radios

CVE-2017-9135

An issue was discovered on Mimosa Client Radios before 2.2.4 and Mimosa Backhaul Radios before 2.2.4. On the backend of the device's web interface, there are some diagnostic tests available that are not displayed on the webpage; these are only accessible by crafting a POST request with a program like cURL. There is one test accessible via cURL that does not properly sanitize user input, allowing an attacker to execute shell commands as the root user.

EPSS: 0.013 (68.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Weakness classification (CWE)

CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection)

Public proof-of-concept exploits

ARPSyndicate/cvemon

References

cve@mitre.org (Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2017-9135?: CVE-2017-9135 is a high-severity vulnerability in Mimosa Backhaul Radios, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 8.8/10. Published 2017-05-21.
How severe is CVE-2017-9135?: High severity. CVSS v3 base score is 8.8 out of 10.
Is CVE-2017-9135 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.