[0day-rubbish] Auerswald COMmander 6000 / 6000R 8.6D unauthenticated provisioning import zip-slip to root binary hijack and root code execution (9.8)
Unauthenticated zip-slip in Auerswald COMmander 6000 firmware 8.6D yields root code execution.
The 0day Rubbish Research Team disclosed an unauthenticated flaw in Auerswald COMmander 6000 and 6000R firmware 8.6D build 128154, German enterprise IP-PBX appliances. Two HTTP requests with no cookie or credential use a provisioning-import zip-slip to hijack a root binary and execute code as uid 0. The appliances hold extension, SIP trunk and call credentials. The issue is scored 9.8; no CVE or in-the-wild exploitation is stated.
- Unauthenticated provisioning import is abused via zip-slip.
- Two credential-free HTTP requests yield uid 0 on the PBX.
- Firmware 8.6D build 128154 stores SIP and extension credentials; scored 9.8.
- Vendors
- Auerswald
- Products
- COMmander 6000COMmander 6000R
- Organizations
- 0day Rubbish Research TeamAuerswald
- Countries
- Germany
From the original article
Posted by disclosure via Fulldisclosure on Oct 15 0day Rubbish Research Team is publicly disclosing a vulnerability in Auerswald COMmander 6000 and COMmander 6000R, firmware 8. 6D build 128154, the closed-source enterprise IP-PBX and unified-communications appliances from Auerswald (Germany).
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.