cve/2019/CVE-2019-20048.md

### [CVE-2019-20048](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20048)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

An issue was discovered on Alcatel-Lucent OmniVista 8770 devices before 4.1.2. An authenticated remote attacker, with elevated privileges in the Web Directory component on port 389, may upload a PHP file to achieve Remote Code Execution as SYSTEM.

### POC

#### Reference
- https://packetstormsecurity.com/files/155595/Alcatel-Lucent-Omnivista-8770-Remote-Code-Execution.html
- https://packetstormsecurity.com/files/155595/Alcatel-Lucent-Omnivista-8770-Remote-Code-Execution.html
- https://www.exploit-db.com/exploits/47761
- https://www.exploit-db.com/exploits/47761

#### Github
No PoCs found on GitHub currently.