CVE-2020-25859— Qualcomm QCMAP 操作系统命令注入漏洞

N/A

The QCMAP_CLI utility in the Qualcomm QCMAP software suite prior to versions released in October 2020 uses a system() call without validating the input, while handling a SetGatewayUrl() request. A local attacker with shell access can pass shell metacharacters and run arbitrary commands. If QCMAP_CLI can be run via sudo or setuid, this also allows elevating privileges to root. This version of QCMAP is used in many kinds of networking devices, primarily mobile hotspots and LTE routers.

N/A

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

Qualcomm QCMAP 操作系统命令注入漏洞

Qualcomm QCMAP是美国高通（Qualcomm）公司的基于Linux的移动电话的数据接入点。 高通 QCMAP CLI 2020年10月版本 存在安全漏洞，该漏洞源于使用system()调用，而不验证输入，同时处理SetGatewayUrl()请求。攻击者可利用该漏洞可以传递shell元字符并运行任意命令。

N/A

N/A