« Volver al listado

CVE-2023-38120

Estado: AnalizadaAlta (8.8)—

Adtran SR400ac ping Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adtran SR400ac routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the ping command, which is available over JSON-RPC. A crafted host parameter can trigger execution of a system call composed from a user-supplied string. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-20525.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Adtran — Sr400ac Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-38120",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-38120",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-07-03T13:36:08.524807Z"
        }
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "zdi-disclosures@trendmicro.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "zdi-disclosures@trendmicro.com",
      "affectedData": [
        {
          "vendor": "Adtran",
          "product": "SR400ac",
          "versions": [
            {
              "status": "affected",
              "version": "10.8.8.1 & 10.8.5.1"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:h:adtran:sr400ac:*:*:*:*:*:*:*:*"
          ],
          "vendor": "adtran",
          "product": "sr400ac",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "12.1.3.1",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-05-03T02:15:56.207",
  "references": [
    {
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1010/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "zdi-disclosures@trendmicro.com"
    },
    {
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1010/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "zdi-disclosures@trendmicro.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Adtran SR400ac ping Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adtran SR400ac routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.\n\nThe specific flaw exists within the ping command, which is available over JSON-RPC. A crafted host parameter can trigger execution of a system call composed from a user-supplied string. An attacker can leverage this vulnerability to execute code in the context of root.\n. Was ZDI-CAN-20525."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de ejecución remota de código de inyección de comando ping de Adtran SR400ac. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de enrutadores Adtran SR400ac. Aunque se requiere autenticación para aprovechar esta vulnerabilidad, se puede omitir el mecanismo de autenticación existente. La falla específica existe en el comando ping, que está disponible a través de JSON-RPC. Un parámetro de host manipulado puede desencadenar la ejecución de una llamada al sistema compuesta por una cadena proporcionada por el usuario. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto de la raíz. Era ZDI-CAN-20525."
    }
  ],
  "lastModified": "2026-06-17T06:09:28.573",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:adtran:sr400ac_firmware:10.8.5.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9D333316-BFBE-47B3-8754-2DA70B7DC111"
            },
            {
              "criteria": "cpe:2.3:o:adtran:sr400ac_firmware:10.8.8.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CA48FE17-D6E2-46F0-9ABB-897D60BBCE88"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:adtran:sr400ac:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "DA06E333-5781-47C3-9EFB-193DB61DFC86"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "zdi-disclosures@trendmicro.com"
}