CVE-2012-5878 json
Bulb Security Smartphone Pentest Framework (SPF) 0.1.2 through 0.1.4 allows remote attackers to execute arbitrary commands via shell metach…
published 2020-01-03 6 y ago modified 2026-06-16 4 mo ago also EUVD-2012-5756
- cvss
- 9.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 9.3%
- EPSS 9.3% chance of exploitation in 30 days, percentile 95%
- public exploits
- 1
- Exploit-DB
Summary
Bulb Security Smartphone Pentest Framework (SPF) 0.1.2 through 0.1.4 allows remote attackers to execute arbitrary commands via shell metacharacters in the hostingPath parameter to (1) SEAttack.pl or (2) CSAttack.pl in frameworkgui/ or the (3) appURLPath parameter to frameworkgui/attachMobileModem.pl.
Timeline
- First public exploit (EDB-38114)
- Published
Exploit prediction
9.30% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- EDB-38114 Smartphone Pentest Framework - Multiple Remote Command Execution Vulnerabilities webapps, 2012-12-10
- htbridge.com https://www.htbridge.com/advisory/HTB23127 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-78 Improper Neutralization of Special Elements used in an OS Command
References
-
htbridge.com
/advisory/HTB23127
exploit, third-party-advisory
-
htbridge.com
/advisory/HTB23123
not-applicable, third-party-advisory
Sources
- CVE List CVE-2012-5878
- NVD CVE-2012-5878
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.