CVE-2017-14127

Critical

Published: 04/09/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The Ping Module in the web interface of Technicolor TD5336 OI_Fw_v7 devices has a command injection vulnerability that allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the pingAddr parameter to mnt_ping.cgi.

Risk Assessment

An attacker could gain full system privileges, potentially leading to severe security breaches and data loss.

Recommendation

It is recommended to update the device firmware to the latest version to mitigate this vulnerability and restrict access to the web interface.

Original NVD description (English source)

Command Injection in the Ping Module in the Web Interface on Technicolor TD5336 OI_Fw_v7 devices allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the pingAddr parameter to mnt_ping.cgi.