huzaifahussain98/cve-2020-23591ARBITAR FILE UPLOAD LEADS TO "delete every file for Denial of Service (using 'rm -rf *.*' in the code), reverse connection (using '.asp' webshell), backdoor , Escalation of Privileges, etc".
OPTILINK E-PON "MODEL NO: OP-XT71000N" with "HARDWARE VERSION: V2.2"; & "FIRMWARE VERSION: OP_V3.3.1-191028"
Found vulnerability in the "OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028" which allows an attacker to upload arbitrary file through " /mgm_dev_upgrade.asp " which can "delete every file for Denial of Service (using 'rm -rf .' in the code), reverse connection (using '.asp' webshell), backdoor , Escalation of Privileges, etc".
TARGET
/mgm_dev_upgrade.asp
Attack Vector
upload arbitrary file through " /mgm_dev_upgrade.asp " which leads to "delete every file for Denial of Service (using 'rm -rf .' in the code), reverse connection (using '.asp' webshell), backdoor , Escalation of Privileges, etc".
REGARDS
Huzaifa Hussain
