CVE-2017-13713

published 2017-09-07

CVE-2017-13713: T&W WIFI Repeater BE126 allows remote authenticated users to execute arbitrary code via shell metacharacters in the user parameter to cgi-bin/webupg.

Priority P2 65 high 8.8 CVSS 3.0

AV N AC L PR L UI N S U C H I H A H

EXPLOIT

T&W WIFI Repeater BE126 allows remote authenticated users to execute arbitrary code via shell metacharacters in the user parameter to cgi-bin/webupg.

Detection & IOCs extracted from sources · hover to see the quote

url http://beconnected.client/cgi-bin/webupg↗

path /cgi-bin/webupg↗

command curl -d "name=HTTP&url="http://www.test.com&user=;echo hacked!! > /var/mycode;&password=a&port=8&dir=a"↗

• → Monitor HTTP POST requests to /cgi-bin/webupg containing shell metacharacters (e.g., semicolons) in the 'user' parameter, which indicates exploitation of unsanitized input leading to RCE. ↗
• → Look for POST requests to /cgi-bin/webupg where the 'user' field contains shell metacharacters such as ';', '>', or '|' — these are the injection vectors for this CVE. ↗
• → Presence of the cookie field 'auth=ok' combined with 'sys_UserName=admin' in requests to /cgi-bin/webupg may indicate an authenticated exploitation attempt. ↗

• · Exploitation requires prior authentication — the attacker must be a remote authenticated user with a valid session cookie (sessionsid, auth=ok) before injecting shell metacharacters. ↗
• · The PoC uses a placeholder device hostname 'beconnected.client'; in real deployments the target address will differ. Detection rules should match on the path /cgi-bin/webupg rather than the hostname. ↗

CVSS provenance

nvd v3.0 8.8 HIGH CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78