mirror of
https://github.com/gobysec/GobyVuls.git
synced 2025-05-29 17:50:42 +00:00
11 lines
648 B
Markdown
11 lines
648 B
Markdown
|
# Yealink Device Management Platform SSRF (CVE-2021-27561)
|
||
|
|
|
||
|
|
Yealink DM (Device Management) platform offers a comprehensive management solution with key features Unified Deployment and Management, Real-Time Monitoring and Alarm, Remote Troubleshooting. By chaining a pre-auth SSRF vulnerability and a command injection vulnerability, it is possible to execute commands as root without authentication against this product, by sending a simple HTTPS request to the remote target.
|
||
|
|
|
||
|
|
**FOFA query rule**: [title="dm-v30"](https://fofa.so/result?qbase64=dGl0bGU9ImRtLXYzMCI%3D)
|
||
|
|
|
||
|
|
# Demo
|
||
|
|
|
||
|
|
|
||
|
|
|