CVE-2017-8862
CriticalSummary
The webupgrade function on the Cohu 3960HD does not verify the firmware upgrade files, allowing an attacker to upload a specially crafted postinstall.sh file that will be executed with 'root' privileges.
Risk Assessment
The lack of verification for upgrade files poses a serious risk of unauthorized control over the device, potentially leading to significant security breaches.
Recommendation
It is recommended to implement verification mechanisms for upgrade files and restrict access to the upgrade function to trusted users.
Other vulnerabilities in Cohu 3960HD
See all- CVE-2017-8863High
CVE-2017-8863 allows information disclosure of .esp source code on the Cohu 3960, enabling an attacker to view sensitive information such as application logic using a simple web browser.
- CVE-2017-8861Critical
Missing authentication for the remote configuration port 1236/tcp on the Cohu 3960HD allows an attacker to change configuration parameters such as IP address and username/password via specially crafted XML SOAP packets.
Original NVD description (English source)
The webupgrade function on the Cohu 3960HD does not verify the firmware upgrade files or process, allowing an attacker to upload a specially crafted postinstall.sh file that will be executed with "root" privileges.