(success) Command injection possible!

hey, could you tell how exactly did you get a copy a firmware image?

Hey looks like vodafone updated the firmware version to AR01.04.046 about a week ago, can you disclose the method now?

No love for this device in 2022 it seems…
Got one from my DE friend but not possible to use it for anything - isp doesnt allow 3rd party devices.
Any tips how to run something usefull on this ?

There is a rule about not reviving such old topics. Please create a new thread on this subject or subject matter you wish to post on.

Hi @max1220

you promised a while ago to give a detailed explanation once the issue is resolved. There has been a year now since the issue was reported, that’s well above the normal regular 3 month timeframe that vendors usually have time to fix an issue before it’s published. As Vodafone has rolled out a new version now, can you finally share what you’ve found (or at least where you’ve found it)? If they didn’t get the fix in for that update they clearly don’t care and by not increasing pressure you are only helping other people who might have an evil intent and found the issue aswell (and I assume if you have found it, someone with more experience could aswell).