""ET EXPLOIT Zhone ZNID GPON 2426A < S3.0.501 RCE (CVE-2014-9118) M2""

SID: 2036750

Revision: 2

Class Type: attempted-admin

Metadata: attack_target Server, created_at 2022_06_02, cve CVE_2014_9118, deployment Perimeter, deployment Internal, signature_severity Major, tag Exploit, updated_at 2024_06_23, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application

Reference:

• cve

• 2014-9118

Protocol: tcp

Source Network: any

Source Port: any

Destination Network: any

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

• Value: "GET"

• Value: "/zhnping.cmd?"

• Value: "test=traceroute"

• Value: "sessionKey="

• Value: "ipAddr="

Within:

PCRE: "/ipAddr=[a-z0-9.]+(?:[\x60\x3b\x7c\x26]|%60|%3b|%7c|%26|(?:[\x3c\x3e\x24]|%3c|%3e|%24)(?:\x28|%28))/Ui"

Special Options:

• http_method

• http_uri

• fast_pattern

• http_uri

• http_uri

• http_uri

source