CVE-2021-43339
📋 TL;DR
CVE-2021-43339 is a command injection vulnerability in Ericsson Network Location software that allows authenticated attackers to execute arbitrary commands via the file_name parameter in export functionality. This could lead to remote code execution, including creating new admin users. Organizations using Ericsson Network Location before July 2021 are affected.
💻 Affected Systems
- Ericsson Network Location
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining administrative control, data exfiltration, lateral movement, and persistent backdoor installation.
Likely Case
Unauthorized administrative access, data manipulation, and potential ransomware deployment within the affected system.
If Mitigated
Limited impact due to network segmentation and strict access controls, potentially only affecting the vulnerable application instance.
🎯 Exploit Status
Multiple public exploit scripts exist. Exploitation requires authenticated access but is straightforward once credentials are obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions from 2021-07-31 onward
Vendor Advisory: Not publicly documented in vendor advisory
Restart Required: Yes
Instructions:
1. Update Ericsson Network Location to version dated 2021-07-31 or later. 2. Restart the application services. 3. Verify the update was successful.
🔧 Temporary Workarounds
Disable export functionality
allTemporarily disable the export feature that contains the vulnerable file_name parameter
Application-specific configuration changes required
Implement input validation
allAdd strict input validation for file_name parameter to reject special characters
Application code modification required
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Ericsson Network Location systems
- Enforce multi-factor authentication and strong credential policies for all admin accounts
🔍 How to Verify
Check if Vulnerable:
Check Ericsson Network Location version date. If before 2021-07-31, the system is vulnerable.Check Version:
Application-specific command or check version in admin interfaceVerify Fix Applied:
Verify the application version shows 2021-07-31 or later date. Test export functionality with malicious input to confirm sanitization.📡 Detection & Monitoring
Log Indicators:
- Unusual export operations
- Commands with special characters in file_name parameter
- New admin user creation logs
Network Indicators:
- Unexpected outbound connections from Ericsson Network Location system
- Command and control traffic patterns
SIEM Query:
source="ericsson_network_location" AND (event="export" AND file_name CONTAINS "|" OR file_name CONTAINS ";" OR file_name CONTAINS "$")🔗 References
- https://pentest.com.tr/blog/RCE-via-Meow-Variant-along-with-an-Example-0day-PacketHackingVillage-Defcon29.html
- https://www.exploit-db.com/exploits/50468
- https://www.exploit-db.com/exploits/50469
- https://pentest.com.tr/blog/RCE-via-Meow-Variant-along-with-an-Example-0day-PacketHackingVillage-Defcon29.html
- https://www.exploit-db.com/exploits/50468
- https://www.exploit-db.com/exploits/50469
