CVE-2019-6288
📋 TL;DR
This vulnerability allows unauthenticated attackers to execute arbitrary commands on Edgecore ECS2020 devices by sending specially crafted HTTP requests to the /EXCU_SHELL URI. It affects Edgecore ECS2020 devices running firmware version 1.0.0.0, enabling remote code execution without authentication.
💻 Affected Systems
- Edgecore ECS2020
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to install persistent backdoors, pivot to internal networks, exfiltrate data, or use the device as part of a botnet.
Likely Case
Remote code execution leading to device takeover, network reconnaissance, and potential lateral movement within the network.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering and network segmentation.
🎯 Exploit Status
Simple HTTP request with command injection in command1 header. Public references demonstrate exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.edge-core.com
Restart Required: No
Instructions:
Check Edgecore website for firmware updates. If available, download and apply latest firmware following vendor instructions.
🔧 Temporary Workarounds
Network Access Control
allRestrict access to device management interface using firewall rules
Disable Web Interface
allDisable HTTP management interface if not required
🧯 If You Can't Patch
- Isolate device in separate VLAN with strict access controls
- Implement network monitoring for suspicious HTTP requests to /EXCU_SHELL
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface or CLI. If version is 1.0.0.0, device is vulnerable.Check Version:
Check via web interface or device consoleVerify Fix Applied:
Verify firmware version is updated beyond 1.0.0.0📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /EXCU_SHELL with command1 header
- Unusual command execution in system logs
Network Indicators:
- HTTP POST requests to /EXCU_SHELL with shell metacharacters in headers
SIEM Query:
http.uri="/EXCU_SHELL" AND http.method="POST"