MB Connect Line mbNET.mini Command Injection Vulnerability in send_sms Action

A command injection vulnerability has been identified in MB connect line mbNET.mini devices running firmware prior to 2.3.3. This vulnerability allows high-privileged remote attackers to execute arbitrary system commands by sending POST requests to the send_sms action. The issue arises from improper handling of special elements used in operating system commands, which could be exploited to gain unauthorized command execution on the affected devices.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device, potentially leading to full control over the device.

Remediation

Users are advised to update to the latest version, 2.3.3.