{"id":218163,"date":"2018-11-13T15:15:00","date_gmt":"2018-11-13T14:15:00","guid":{"rendered":"https:\/\/www.intrinsec.com\/?p=218163"},"modified":"2018-11-13T15:15:00","modified_gmt":"2018-11-13T14:15:00","slug":"cve-2018-15481-ucopia-wireless-appliance-restricted-shell-escape-5-1-13","status":"publish","type":"post","link":"https:\/\/www.intrinsec.com\/en\/cve-2018-15481-ucopia-wireless-appliance-restricted-shell-escape-5-1-13\/","title":{"rendered":"CVE-2018-15481 UCOPIA Wireless Appliance restricted shell escape (< 5.1.13)"},"content":{"rendered":"<h1>Summary<\/h1>\n<p><strong>Vendor:<\/strong> UCOPIA<\/p>\n<p><strong>Product:<\/strong> Wireless Appliance<\/p>\n<p><strong>Title:<\/strong> UCOPIA Wireless Appliance restricted shell escape (&lt; 5.1.13)<\/p>\n<p><strong>CVE ID:<\/strong> <a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=2018-15481\">CVE-2018-15481<\/a><\/p>\n<p><strong>Intrinsec ID:<\/strong>\u00a0ISEC-V2018-01<\/p>\n<p><strong>Risk level:<\/strong> medium<\/p>\n<p><strong>Exploitability:<\/strong><\/p>\n<ul>\n<li>Authenticated (an admin account is required \u2013 default credentials from the documentation: admin \/ bhu85tgb),<\/li>\n<li>Remotely if interfaces are exposed (SSH TCP\/22 or Web SSH on TCP\/222).<\/li>\n<\/ul>\n<p><strong>Impact: <\/strong>restricted shell escape: a malicious administrator could run undesired commands.<\/p>\n<p><strong>Variant of:<\/strong> <a href=\"https:\/\/www.intrinsec.com\/en\/2018\/03\/19\/cve-2017-17743-ucopia-shell-escape\/\">CVE-2017-17743<\/a><\/p>\n<h1>Description<\/h1>\n<p>Administrators can connect to their UCOPIA Wireless Appliance using the SSH (TCP\/22) or Web SSH (TCP\/222) interfaces. The system shell is restricted through the usage of <em>rbash<\/em> and <em>clish<\/em>: specific commands or flags are disallowed on purpose, therefore a malicious administrator might want to escape from this shell in order to execute arbitrary commands.<\/p>\n<p>The vulnerability lies in the handling of the <em>~\/<\/em><em>.ssh\/config<\/em> file on the UCOPIA system: OpenSSH reads this file when connecting to other machines through SSH. However, a malicious administrator could abuse the <em>LocalCommand<\/em> instruction to start a <em>sh<\/em> shell locally after establishing the connection, and therefore obtaining an unrestricted shell.<\/p>\n<p>The impact is the same as in the previous escape we disclosed with <a href=\"https:\/\/www.intrinsec.com\/en\/2018\/03\/19\/cve-2017-17743-ucopia-shell-escape\/\">CVE-2017-17743<\/a>.<\/p>\n<h1>Exploitation steps<\/h1>\n<p>Login as admin (SSH \/ Web SSH): you obtain a restricted shell (the prompt is \u00ab&gt;\u00bb).<\/p>\n<p>Then, use <em>scp<\/em>\u00a0(or any other available technique) on the appliance to retrieve a malicious <em>.ssh\/config <\/em>file from the attacker machine. The malicious <em>~\/<\/em><em>.ssh\/config <\/em>file must contain this content:<\/p>\n<div id=\"crayon-5beadb1dcd8cd732929493\" class=\"crayon-syntax crayon-theme-github crayon-font-monaco crayon-os-pc print-yes notranslate\" data-settings=\" minimize scroll-mouseover\">\n<div class=\"crayon-plain-wrap\"><textarea class=\"crayon-plain print-no\" readonly=\"readonly\" wrap=\"soft\" data-settings=\"dblclick\">Host *<br \/>\n PermitLocalCommand yes<br \/>\n LocalCommand sh<br \/>\n User root<\/textarea><\/div>\n<div class=\"crayon-main\">\n<table class=\"crayon-table\">\n<tbody>\n<tr class=\"crayon-row\">\n<td class=\"crayon-nums\" data-settings=\"show\">\n<div class=\"crayon-nums-content\">\n<div class=\"crayon-num\" data-line=\"crayon-5beadb1dcd8cd732929493-1\">1<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5beadb1dcd8cd732929493-2\">2<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5beadb1dcd8cd732929493-3\">3<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5beadb1dcd8cd732929493-4\">4<\/div>\n<\/div>\n<\/td>\n<td class=\"crayon-code\">\n<div class=\"crayon-pre\">\n<div id=\"crayon-5beadb1dcd8cd732929493-1\" class=\"crayon-line\"><span class=\"crayon-e\">Host *<\/span><\/div>\n<div id=\"crayon-5beadb1dcd8cd732929493-2\" class=\"crayon-line crayon-striped-line\"><span class=\"crayon-e\">PermitLocalCommand <\/span><span class=\"crayon-e\">yes<\/span><\/div>\n<div id=\"crayon-5beadb1dcd8cd732929493-3\" class=\"crayon-line\"><span class=\"crayon-e\">LocalCommand <\/span><span class=\"crayon-e\">sh<\/span><\/div>\n<div id=\"crayon-5beadb1dcd8cd732929493-4\" class=\"crayon-line crayon-striped-line\"><span class=\"crayon-e\">User <\/span><span class=\"crayon-v\">root<\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<ul>\n<li><em>PermitLocalCommand<\/em> allows the usage of the <em>LocalCommand<\/em> instruction. We can do this since it is not unauthorized by the global SSH configuration.<\/li>\n<li><em>LocalCommand<\/em> is the command to run after establishing the SSH connection. Here we want an unrestricted shell, so we choose <em>\u00ab&quot;sh&quot;\u00bb<\/em>.<\/li>\n<\/ul>\n<p>We prepare the malicious <em>.ssh\/config<\/em> on attacker&#039;s side and store it in <em>\/tmp\/config<\/em>:<\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-full wp-image-4136\" src=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/08\/ucopia-CVE-2018-xxxx-2.png\" alt=\"\" width=\"252\" height=\"90\" \/><\/p>\n<p>We download the file from the attacker&#039;s machine (172.16.17.43) on the appliance and save it in <em>~\/.ssh\/config<\/em>:<\/p>\n<p><img fetchpriority=\"high\" decoding=\"async\" class=\"aligncenter size-full wp-image-4135\" src=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/08\/ucopia-CVE-2018-xxxx-1.png\" sizes=\"(max-width: 488px) 100vw, 488px\" srcset=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/08\/ucopia-CVE-2018-xxxx-1.png 488w, https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/08\/ucopia-CVE-2018-xxxx-1-300x79.png 300w, https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/08\/ucopia-CVE-2018-xxxx-1-280x74.png 280w\" alt=\"\" width=\"488\" height=\"129\" \/><\/p>\n<p>We confirm that the file is present and we connect again to the attacker&#039;s machine (172.16.17.43), this time with <em>ssh<\/em>. We can see that we obtain an unrestricted shell (see the normal \u00ab$\u00bb prompt) after establishing the connection.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-full wp-image-4138\" src=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/08\/ucopia-CVE-2018-xxxx-4.png\" sizes=\"(max-width: 492px) 100vw, 492px\" srcset=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/08\/ucopia-CVE-2018-xxxx-4.png 492w, https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/08\/ucopia-CVE-2018-xxxx-4-300x77.png 300w, https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/08\/ucopia-CVE-2018-xxxx-4-280x72.png 280w\" alt=\"\" width=\"492\" height=\"127\" \/><\/p>\n<p>We are in a <em>chroot<\/em> sandbox, therefore many classic commands are missing, eg:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-4139\" src=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/08\/ucopia-CVE-2018-xxxx-5.png\" alt=\"\" width=\"234\" height=\"41\" \/><\/p>\n<h1>versions affected<\/h1>\n<p>All versions before (&lt;) 5.1.13.<\/p>\n<h1>Solutions<\/h1>\n<p>Upgrade to the latest version, at least 5.1.13.<\/p>\n<p>Please note that Intrinsec has not reviewed the security fix.<\/p>\n<h1>Credits<\/h1>\n<p>Vulnerability discovered by Cl\u00e9ment Notin \/ <a href=\"https:\/\/twitter.com\/cnotin\">@cnotin<\/a>.<\/p>\n<p>Vulnerability disclosed in coordination with Ucopia and the CERT-Intrinsec.<\/p>\n<h1>External references<\/h1>\n<p>Miter: <a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=2018-15481\">CVE-2018-15481<\/a><\/p>\n<h1>History<\/h1>\n<ul>\n<li>2018-04-11: vulnerability discovery<\/li>\n<li>2018-04-13: Advisory ready<\/li>\n<li>2018-04-16: advisory sent to UCOPIA<\/li>\n<li>2018-04-17: UCOPIA confirms the vulnerability<\/li>\n<li>2018-05-11: UCOPIA plans a fix for the next release<\/li>\n<li>2018-07-xx: version 5.1.13 including the fix is available<\/li>\n<li>2018-08-06: update available for all customers<\/li>\n<li>2018-08-20: CVE number assigned<\/li>\n<li>2018-08-20: Intrinsec publishes its advisory<\/li>\n<\/ul>\n<p><em>\u2014 Cl\u00e9ment Notin<\/em><\/p>\n<p>&nbsp;<\/p>","protected":false},"excerpt":{"rendered":"<p>Summary Vendor: UCOPIA Product: Wireless Appliance Title: UCOPIA Wireless Appliance restricted shell escape (&lt; 5.1.13) [&hellip;]<\/p>\n","protected":false},"author":13,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-218163","post","type-post","status-publish","format-standard","hentry","category-non-categorise"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v28.0 (Yoast SEO v28.1) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Intrinsec - CVE-2018-15481 UCOPIA Wireless Appliance restricted shell escape (&lt; 5.1.13)<\/title>\n<meta name=\"description\" content=\"Administrators can connect to their UCOPIA Wireless Appliance using the SSH (TCP\/22) or Web SSH (TCP\/222) interfaces. The system shell is restricted through the usage of rbash and clish: specific commands or flags are disallowed on purpose, therefore a malicious administrator might want to escape from this shell in order to execute arbitrary commands.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.intrinsec.com\/en\/cve-2018-15481-ucopia-wireless-appliance-restricted-shell-escape-5-1-13\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Intrinsec - CVE-2018-15481 UCOPIA Wireless Appliance restricted shell escape (&lt; 5.1.13)\" \/>\n<meta property=\"og:description\" content=\"Administrators can connect to their UCOPIA Wireless Appliance using the SSH (TCP\/22) or Web SSH (TCP\/222) interfaces. The system shell is restricted through the usage of rbash and clish: specific commands or flags are disallowed on purpose, therefore a malicious administrator might want to escape from this shell in order to execute arbitrary commands.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.intrinsec.com\/en\/cve-2018-15481-ucopia-wireless-appliance-restricted-shell-escape-5-1-13\/\" \/>\n<meta property=\"og:site_name\" content=\"INTRINSEC\" \/>\n<meta property=\"article:published_time\" content=\"2018-11-13T14:15:00+00:00\" \/>\n<meta name=\"author\" content=\"Admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:title\" content=\"CVE-2018-15481 UCOPIA Wireless Appliance restricted shell escape (&lt; 5.1.13)\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/08\/ucopia-CVE-2018-xxxx-2.png\" \/>\n<meta name=\"twitter:creator\" content=\"@Intrinsec\" \/>\n<meta name=\"twitter:site\" content=\"@Intrinsec\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/cve-2018-15481-ucopia-wireless-appliance-restricted-shell-escape-5-1-13\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/cve-2018-15481-ucopia-wireless-appliance-restricted-shell-escape-5-1-13\\\/\"},\"author\":{\"name\":\"Admin\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/person\\\/5636e3e5276b952facbd0aadb12a858a\"},\"headline\":\"CVE-2018-15481 UCOPIA Wireless Appliance restricted shell escape (< 5.1.13)\",\"datePublished\":\"2018-11-13T14:15:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/cve-2018-15481-ucopia-wireless-appliance-restricted-shell-escape-5-1-13\\\/\"},\"wordCount\":493,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/cve-2018-15481-ucopia-wireless-appliance-restricted-shell-escape-5-1-13\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2018\\\/08\\\/ucopia-CVE-2018-xxxx-2.png\",\"articleSection\":[\"Non cat\u00e9goris\u00e9\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.intrinsec.com\\\/cve-2018-15481-ucopia-wireless-appliance-restricted-shell-escape-5-1-13\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/cve-2018-15481-ucopia-wireless-appliance-restricted-shell-escape-5-1-13\\\/\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/cve-2018-15481-ucopia-wireless-appliance-restricted-shell-escape-5-1-13\\\/\",\"name\":\"Intrinsec - CVE-2018-15481 UCOPIA Wireless Appliance restricted shell escape (< 5.1.13)\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/cve-2018-15481-ucopia-wireless-appliance-restricted-shell-escape-5-1-13\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/cve-2018-15481-ucopia-wireless-appliance-restricted-shell-escape-5-1-13\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2018\\\/08\\\/ucopia-CVE-2018-xxxx-2.png\",\"datePublished\":\"2018-11-13T14:15:00+00:00\",\"description\":\"Administrators can connect to their UCOPIA Wireless Appliance using the SSH (TCP\\\/22) or Web SSH (TCP\\\/222) interfaces. The system shell is restricted through the usage of rbash and clish: specific commands or flags are disallowed on purpose, therefore a malicious administrator might want to escape from this shell in order to execute arbitrary commands.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/cve-2018-15481-ucopia-wireless-appliance-restricted-shell-escape-5-1-13\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.intrinsec.com\\\/cve-2018-15481-ucopia-wireless-appliance-restricted-shell-escape-5-1-13\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/cve-2018-15481-ucopia-wireless-appliance-restricted-shell-escape-5-1-13\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2018\\\/08\\\/ucopia-CVE-2018-xxxx-2.png\",\"contentUrl\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2018\\\/08\\\/ucopia-CVE-2018-xxxx-2.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/cve-2018-15481-ucopia-wireless-appliance-restricted-shell-escape-5-1-13\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\\\/\\\/www.intrinsec.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"CVE-2018-15481 UCOPIA Wireless Appliance restricted shell escape (< 5.1.13)\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#website\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/\",\"name\":\"INTRINSEC\",\"description\":\"Notre m\u00e9tier , Prot\u00e9ger le v\u00f4tre\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.intrinsec.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#organization\",\"name\":\"INTRINSEC\",\"alternateName\":\"ISEC\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/libellule.png\",\"contentUrl\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/libellule.png\",\"width\":1322,\"height\":1322,\"caption\":\"INTRINSEC\"},\"image\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/Intrinsec\",\"https:\\\/\\\/fr.linkedin.com\\\/company\\\/intrinsec\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UC0trUZAHNZOUbxYnNdecM4A\"],\"description\":\"soci\u00e9t\u00e9 de consulting, pure player cybers\u00e9curit\u00e9 fran\u00e7ais et europ\u00e9en depuis plus de 30ans, sp\u00e9cialiste dans la s\u00e9curit\u00e9 offensive & audit (pentest\\\/red team), GRC, et services IMSS comme le SOC, CTI et CERT Intrinsec est qualifi\u00e9 PASSI Elev\u00e9, PRIS Elev\u00e9 et PACS par l'ANSSI\",\"email\":\"contact@intrinsec.com\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/person\\\/5636e3e5276b952facbd0aadb12a858a\",\"name\":\"Admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/?s=96&d=retro&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/?s=96&d=retro&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/?s=96&d=retro&r=g\",\"caption\":\"Admin\"},\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/en\\\/author\\\/admin\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Intrinsec - CVE-2018-15481 UCOPIA Wireless Appliance restricted shell escape (< 5.1.13)","description":"Administrators can connect to their UCOPIA Wireless Appliance using the SSH (TCP\/22) or Web SSH (TCP\/222) interfaces. The system shell is restricted through the usage of rbash and clish: specific commands or flags are disallowed on purpose, therefore a malicious administrator might want to escape from this shell in order to execute arbitrary commands.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.intrinsec.com\/en\/cve-2018-15481-ucopia-wireless-appliance-restricted-shell-escape-5-1-13\/","og_locale":"en_US","og_type":"article","og_title":"Intrinsec - CVE-2018-15481 UCOPIA Wireless Appliance restricted shell escape (&lt; 5.1.13)","og_description":"Administrators can connect to their UCOPIA Wireless Appliance using the SSH (TCP\/22) or Web SSH (TCP\/222) interfaces. The system shell is restricted through the usage of rbash and clish: specific commands or flags are disallowed on purpose, therefore a malicious administrator might want to escape from this shell in order to execute arbitrary commands.","og_url":"https:\/\/www.intrinsec.com\/en\/cve-2018-15481-ucopia-wireless-appliance-restricted-shell-escape-5-1-13\/","og_site_name":"INTRINSEC","article_published_time":"2018-11-13T14:15:00+00:00","author":"Admin","twitter_card":"summary_large_image","twitter_title":"CVE-2018-15481 UCOPIA Wireless Appliance restricted shell escape (< 5.1.13)","twitter_image":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/08\/ucopia-CVE-2018-xxxx-2.png","twitter_creator":"@Intrinsec","twitter_site":"@Intrinsec","twitter_misc":{"Written by":"Admin","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.intrinsec.com\/cve-2018-15481-ucopia-wireless-appliance-restricted-shell-escape-5-1-13\/#article","isPartOf":{"@id":"https:\/\/www.intrinsec.com\/cve-2018-15481-ucopia-wireless-appliance-restricted-shell-escape-5-1-13\/"},"author":{"name":"Admin","@id":"https:\/\/www.intrinsec.com\/#\/schema\/person\/5636e3e5276b952facbd0aadb12a858a"},"headline":"CVE-2018-15481 UCOPIA Wireless Appliance restricted shell escape (< 5.1.13)","datePublished":"2018-11-13T14:15:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.intrinsec.com\/cve-2018-15481-ucopia-wireless-appliance-restricted-shell-escape-5-1-13\/"},"wordCount":493,"commentCount":0,"publisher":{"@id":"https:\/\/www.intrinsec.com\/#organization"},"image":{"@id":"https:\/\/www.intrinsec.com\/cve-2018-15481-ucopia-wireless-appliance-restricted-shell-escape-5-1-13\/#primaryimage"},"thumbnailUrl":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/08\/ucopia-CVE-2018-xxxx-2.png","articleSection":["Non cat\u00e9goris\u00e9"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.intrinsec.com\/cve-2018-15481-ucopia-wireless-appliance-restricted-shell-escape-5-1-13\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.intrinsec.com\/cve-2018-15481-ucopia-wireless-appliance-restricted-shell-escape-5-1-13\/","url":"https:\/\/www.intrinsec.com\/cve-2018-15481-ucopia-wireless-appliance-restricted-shell-escape-5-1-13\/","name":"Intrinsec - CVE-2018-15481 UCOPIA Wireless Appliance restricted shell escape (< 5.1.13)","isPartOf":{"@id":"https:\/\/www.intrinsec.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.intrinsec.com\/cve-2018-15481-ucopia-wireless-appliance-restricted-shell-escape-5-1-13\/#primaryimage"},"image":{"@id":"https:\/\/www.intrinsec.com\/cve-2018-15481-ucopia-wireless-appliance-restricted-shell-escape-5-1-13\/#primaryimage"},"thumbnailUrl":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/08\/ucopia-CVE-2018-xxxx-2.png","datePublished":"2018-11-13T14:15:00+00:00","description":"Administrators can connect to their UCOPIA Wireless Appliance using the SSH (TCP\/22) or Web SSH (TCP\/222) interfaces. The system shell is restricted through the usage of rbash and clish: specific commands or flags are disallowed on purpose, therefore a malicious administrator might want to escape from this shell in order to execute arbitrary commands.","breadcrumb":{"@id":"https:\/\/www.intrinsec.com\/cve-2018-15481-ucopia-wireless-appliance-restricted-shell-escape-5-1-13\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.intrinsec.com\/cve-2018-15481-ucopia-wireless-appliance-restricted-shell-escape-5-1-13\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.intrinsec.com\/cve-2018-15481-ucopia-wireless-appliance-restricted-shell-escape-5-1-13\/#primaryimage","url":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/08\/ucopia-CVE-2018-xxxx-2.png","contentUrl":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/08\/ucopia-CVE-2018-xxxx-2.png"},{"@type":"BreadcrumbList","@id":"https:\/\/www.intrinsec.com\/cve-2018-15481-ucopia-wireless-appliance-restricted-shell-escape-5-1-13\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.intrinsec.com\/"},{"@type":"ListItem","position":2,"name":"CVE-2018-15481 UCOPIA Wireless Appliance restricted shell escape (< 5.1.13)"}]},{"@type":"WebSite","@id":"https:\/\/www.intrinsec.com\/#website","url":"https:\/\/www.intrinsec.com\/","name":"INTRINSEC","description":"Our job is to protect yours.","publisher":{"@id":"https:\/\/www.intrinsec.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.intrinsec.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.intrinsec.com\/#organization","name":"INTRINSEC","alternateName":"ISEC","url":"https:\/\/www.intrinsec.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.intrinsec.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/02\/libellule.png","contentUrl":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/02\/libellule.png","width":1322,"height":1322,"caption":"INTRINSEC"},"image":{"@id":"https:\/\/www.intrinsec.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/Intrinsec","https:\/\/fr.linkedin.com\/company\/intrinsec","https:\/\/www.youtube.com\/channel\/UC0trUZAHNZOUbxYnNdecM4A"],"description":"Intrinsec, a consulting firm and pure-play French and European cybersecurity provider for over 30 years, specializes in offensive security and auditing (penetration testing\/red teams), GRC, and IMSS services such as SOC, CTI, and CERT. Intrinsec is qualified at PASSI High, PRIS High, and PACS levels by ANSSI.","email":"contact@intrinsec.com"},{"@type":"Person","@id":"https:\/\/www.intrinsec.com\/#\/schema\/person\/5636e3e5276b952facbd0aadb12a858a","name":"Admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/?s=96&d=retro&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/?s=96&d=retro&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/?s=96&d=retro&r=g","caption":"Admin"},"url":"https:\/\/www.intrinsec.com\/en\/author\/admin\/"}]}},"_links":{"self":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts\/218163","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/users\/13"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/comments?post=218163"}],"version-history":[{"count":0,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts\/218163\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/media?parent=218163"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/categories?post=218163"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/tags?post=218163"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}