Cambium ePMP1000 'get_chart' Shell via Command Injection (v3.1-3.5-RC7)
This module exploits an OS Command Injection vulnerability in Cambium ePMP1000 device management portal. It requires any one of the following login credentials - admin/admin, installer/installer, home/home - to set up a reverse netcat shell. The module has been tested on versions 3.1-3.5-RC7.
Module Name
exploit/unix/http/epmp1000_get_chart_cmd_shell
Authors
- Karn Ganeshen <KarnGaneshen [at] gmail.com>
References
Targets
- CMD
Platforms
- unix
Architectures
- cmd
Reliability
Development
Module Options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/unix/http/epmp1000_get_chart_cmd_shell
msf exploit(epmp1000_get_chart_cmd_shell) > show targets
...targets...
msf exploit(epmp1000_get_chart_cmd_shell) > set TARGET <target-id>
msf exploit(epmp1000_get_chart_cmd_shell) > show options
...show and set options...
msf exploit(epmp1000_get_chart_cmd_shell) > exploit