Arbitrary Command Execution in Alcatel-Lucent I-240W-Q
The Alcatel-Lucent I-240W-Q ONT's Diagnostics page does not filter shell metacharacters in the IP address field, allowing any authenticated administrator to execute arbitrary commands as root and fully compromise the device.
CVSS Score
Severity
CVSS Vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H Advisory
| Device | Alcatel-Lucent I-240W-Q |
| Hardware | 0068-5C-01 |
| Software | 3FE53862BOCA53 |
| Impact | Authenticated arbitrary command execution as root |
Description
The administrative web interface exposes Maintenance → Diagnostics, which runs ping and traceroute against an IP address supplied by the administrator. The IP Address field is not filtered for shell metacharacters, so appending a ; followed by another command executes that command on the device.
The injected commands run with root privileges, granting full control of the device to any administrator — which, for devices deployed with the default web-admin credentials, is effectively anyone who can reach the interface.
Exploit / Proof of Concept
IP Address field: 127.0.0.1; id; cat /etc/passwdRemediation
No vendor fix. Restrict admin access to trusted hosts and change default credentials.