Perle IOLAN STS/SCS terminal server (firmware before 6.0): A logged-in user of the restricted admin shell (Telnet

Impact

A logged-in user of the restricted admin shell (Telnet or SSH) can break out of that shell and run arbitrary OS commands as root. The 'ps' subcommand doesn't sanitize its arguments before handing them to a shell, so an operator account that was only supposed to have limited diagnostic access ends up with full root on the terminal server.

Who can reach it

Requires an authenticated login to the restricted shell (any account that can reach the 'ps' command), then injects shell metacharacters after the subcommand.

What to do

Firmware upgrade to 6.0 or later — this is a shell-sanitization bug in the restricted-admin feature, not something a permission change alone fixes. Flash each terminal server one at a time; expect a brief loss of the serial sessions it's terminating during the reboot.

References