Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%

CVE-2020-23583 PoC — Optilink Network OP-XT71000N 命令注入漏洞

Source
Associated Vulnerability
Title:Optilink Network OP-XT71000N 命令注入漏洞 (CVE-2020-23583)
Description:Optilink Network OP-XT71000N是印度Optilink Network公司的一款无线路由器。 Optilink Network OP-XT71000N V2.2版本存在命令注入漏洞,该漏洞源于攻击者在“/diag_ping_admin.asp“上向“PingTest”接口发送导致COMMAND EXECUTION的任意代码时可以实现远程代码执行。
Description
REMOTE CODE EXECUTION found in "OPTILINK OP-XT71000N".
Readme
# CVE-2020-23583

**OPTILINK E-PON "MODEL NO: OP-XT71000N" with "HARDWARE VERSION: V2.2"; & "FIRMWARE VERSION: OP_V3.3.1-191028"**  

REMOTE CODE EXECUTION found in "OPTILINK OP-XT71000N". The issue occurs when the attacker sends an arbitrary code on "/diag_ping_admin.asp" to "PingTest" interface that leads to COMMAND EXECUTION. An attacker can successfully trigger the COMMAND and can compromise full system.

**TARGET**

/diag_ping_admin.asp

**Attack Vector**

pass arbitrary commands with IP-ADDRESS using " | " to execute commands.

**REGARDS**

Huzaifa Hussain

https://twitter.com/disguised_noob

https://www.linkedin.com/in/huzaifa-hussain-046791179
File Snapshot

[4.0K] /data/pocs/5bff2bd0f0697e723e7f183b12ddc09dedd1c666 └── [ 660] README.md 0 directories, 1 file
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).
    3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.