Arbitrary Command Execution in Alcatel-Lucent I-240W-Q
The Alcatel-Lucent I-240W-Q ONT's Diagnostics page does not filter shell metacharacters in the IP address field, allowing any authenticated administrator to execute arbitrary commands as root and fully compromise the device.
- CVSS Score
- 8.0 / 10.0
- Severity
- High
- CVSS Vector
-
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Advisory
| Device | Alcatel-Lucent I-240W-Q |
| Hardware | 0068-5C-01 |
| Software | 3FE53862BOCA53 |
| Impact | Authenticated arbitrary command execution as root |
Description
The administrative web interface exposes Maintenance → Diagnostics, which runs ping and traceroute against an IP address supplied by the administrator. The IP Address field is not filtered for shell metacharacters, so appending a ; followed by another command executes that command on the device.
The injected commands run with root privileges, granting full control of the device to any administrator — which, for devices deployed with the default web-admin credentials, is effectively anyone who can reach the interface.
Exploit / Proof of Concept
IP Address field: 127.0.0.1; id; cat /etc/passwdRemediation
No vendor fix. Restrict admin access to trusted hosts and change default credentials.