$ cve CVE-2019-7385 JSON

CVE-2019-7385 EXPLOIT

7.8

HIGH · CVSS 3.1 · EPSS 12.2% (pctl 96)

Patch early

A public exploit exists.

Description

An authenticated shell command injection issue has been discovered in Raisecom ISCOM HT803G-U, HT803G-W, HT803G-1GE, and HT803G GPON products with the firmware version ISCOMHT803G-U_2.0.0_140521_R4.1.47.002 or below, The values of the newpass and confpass parameters in /bin/WebMGR are used in a system call in the firmware. Because there is no user input validation, this leads to authenticated code execution on the device.

Scoring

CVSS	7.8 (HIGH, v3.1)
Vector	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS	12.17% — more likely to be exploited than 96% of all CVEs
Weakness	CWE-78
On CISA KEV	no
Public exploit	yes
Published	2019-03-21
Last modified	2026-06-17

Affected (8)

Vendor	Product
raisecom	iscom ht803g gpon
raisecom	iscom ht803g gpon firmware
raisecom	iscom ht803g-1ge
raisecom	iscom ht803g-1ge firmware
raisecom	iscom ht803g-u
raisecom	iscom ht803g-u firmware
raisecom	iscom ht803g-w
raisecom	iscom ht803g-w firmware

Public exploits

Source	Title	Date
exploit-db	Raisecom XPON ISCOMHT803G-U_2.0.0_140521_R4.1.47.002 - Remote Code Execution	2019-03-04

References

→ the Explorer · watch your stack · NVD