CVE-2025-56498 (CNNVD-202509-269)
中文标题:
PLDT WiFi Router Prolink PGN6401V 安全漏洞
英文标题:
An OS command injection vulnerability exists in PLDT WiFi Router's Prolink PGN6401V Firmware 8.1.2 w...
漏洞描述
中文描述:
PLDT WiFi Router Prolink PGN6401V是菲律宾PLDT公司的一款路由器。 PLDT WiFi Router Prolink PGN6401V Firmware 8.1.2版本存在安全漏洞，该漏洞源于ping6.asp页面中对pingAddr参数清理不足，可能导致OS命令注入。
英文描述:
An OS command injection vulnerability exists in PLDT WiFi Router's Prolink PGN6401V Firmware 8.1.2 web management interface. The ping6.asp page submits user input to the /boaform/formPing6 endpoint via the pingAddr parameter, which is not properly sanitized. An authenticated attacker can exploit this flaw by injecting arbitrary system commands, which are executed by the underlying operating system with root privileges. The router uses the Boa web server (version 0.93.15) to handle the request. Successful exploitation can lead to full system compromise and unauthorized control of the network device.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| prolink2u | pgn6401v_firmware | * | - | - |
cpe:2.3:o:prolink2u:pgn6401v_firmware:*:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
3.1 (adp)
MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2025-56498 |
2025-11-11 15:23:29 | 2025-11-11 07:40:44 |
| NVD | nvd_CVE-2025-56498 |
2025-11-11 15:01:01 | 2025-11-11 07:48:31 |
| CNNVD | cnnvd_CNNVD-202509-269 |
2025-11-11 15:12:55 | 2025-11-11 08:00:11 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 其他
- cnnvd_id: 未提取 -> CNNVD-202509-269
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- affected_products_count: 0 -> 1
- data_sources: ['cve'] -> ['cve', 'nvd']