Yoggie Pico and Pico Pro Backticks Remote Code Execution Vulnerability

Bugtraq ID:	24743
Class:	Input Validation Error
CVE:	CVE-2007-3572
Remote:	Yes
Local:	No
Published:	Jul 02 2007 12:00AM
Updated:	May 07 2015 05:37PM
Credit:	Cody Brocious is credited with the discovery of this vulnerability.
Vulnerable:	Yoggie Pico Pro 0 Yoggie Pico 0
Not Vulnerable:

Yoggie Pico and Pico Pro Backticks Remote Code Execution Vulnerability

Yoggie Pico and Pico Pro are prone to a remote code-execution vulnerability because the device fails to sufficiently sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary code with superuser privileges. A successful exploit will result in the complete compromise of affected devices.

Yoggie Pico and Pico Pro Backticks Remote Code Execution Vulnerability

Attackers may exploit this issue through a browser.

The following proof of concept demonstrates this issue:

• /data/vulnerabilities/exploits/24743.txt

Yoggie Pico and Pico Pro Backticks Remote Code Execution Vulnerability

Solution:
The vendor has released a fix to address this issue. The vendor states that the fix is applied via an automatic update. Please contact the vendor for details.

Yoggie Pico and Pico Pro Backticks Remote Code Execution Vulnerability

References:

• Yoggie Pico Home Page (Yoggie)