Security readout for executives and security teams
Plain-English summary
This CVE describes a command-execution flaw in Bulb Security Smartphone Pentest Framework versions 0.1.2 through 0.1.4. If the vulnerable web-facing scripts are reachable, an attacker could make the server run unintended operating-system commands. The product appears old and specialized, so exposure is likely limited but serious where present.
Executive priority
Prioritize remediation if this framework is present in any reachable lab, assessment, or admin environment. If not found, record the inventory result and close as no known exposure.
Technical view
The reported issue is shell metacharacter handling in the hostingPath parameter of frameworkgui/SEAttack.pl and CSAttack.pl, and appURLPath in frameworkgui/attachMobileModem.pl. The source bundle does not provide CVSS, CWE, authentication context, patch details, or confirmed exploit telemetry.
Likely exposure
Most organizations are unlikely to run this legacy smartphone pentest framework. Exposure matters for security labs, older assessment environments, or internet-reachable internal tooling where SPF 0.1.2 through 0.1.4 remains deployed.
Exploitation context
CISA KEV is false in the provided bundle, and no cited source states active exploitation. The description supports remote arbitrary command execution, but available evidence is incomplete on prerequisites and exploit maturity.
Researcher notes
The public bundle identifies vulnerable parameters and affected SPF versions, but lacks CVSS, CWE, detailed advisory text, and patch status. Treat conclusions about authentication, default exposure, and exploit availability as unconfirmed.
Mitigation direction
- Inventory and remove SPF 0.1.2 through 0.1.4 where it is no longer required.
- Restrict any SPF web interface to trusted administrative networks only.
- Check the HTBridge advisories and vendor guidance for fixed versions or workarounds.
- Do not expose frameworkgui Perl scripts directly to the internet.
Validation and detection
- Search asset inventory for Bulb Security Smartphone Pentest Framework deployments.
- Confirm installed SPF version where the tool still exists.
- Review web routing for frameworkgui/SEAttack.pl, CSAttack.pl, and attachMobileModem.pl exposure.
- Review access logs for suspicious requests to the named parameters.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2012-5878 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.htbridge.com/advisory/HTB23123CVE reference · x_refsource_MISC
- https://www.htbridge.com/advisory/HTB23127CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.