CVE-2017-9807

Critical

Published: 22/06/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The OpenWebif plugin up to version 1.2.4 for E2 devices has a vulnerability that allows unauthorized code execution. The saveConfig function in 'plugin/controllers/models/config.py' performs eval() on the contents of the 'key' HTTP GET parameter.

Risk Assessment

An unauthenticated remote attacker can execute arbitrary Python code or OS commands, posing a serious security threat to the system.

Recommendation

It is recommended to update the OpenWebif plugin to the latest version to mitigate this vulnerability. Access to the api/saveconfig function should also be restricted.

Original NVD description (English source)

An issue was discovered in the OpenWebif plugin through 1.2.4 for E2 open devices. The saveConfig function of "plugin/controllers/models/config.py" performs an eval() call on the contents of the "key" HTTP GET parameter. This allows an unauthenticated remote attacker to execute arbitrary Python code or OS commands via api/saveconfig.