Other nomination
NetModule Router Software Race Condition Leads to Remote Code Execution
NetModule NRSW's gnssAutoAlign.php escapes device_id before starting the alignment helper, but the other branch runs exec("kill $(cat " . PID_FILENAME . ")") with the raw id concatenated into that path, and it is reachable only while the status file says the process is not disabled. Two concurrent authenticated requests race the helper's trap cleanup: the first leaves status starting, the second reads it and hits the kill line, so $(...) inside device_id runs as root.
Record
- Researcher
- Nuri Çilengir
- Format
- Advisory
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Nuri Çilengir, first published at the original source. Preserved copies are kept so the citation survives its host.