Lucene search

MitreCVE-2020-12246

HistoryApr 29, 2020 - 1:15 p.m.

CVE-2020-12246

2020-04-2913:15:11

CWE-78

mitre

web.nvd.nist.gov

beeline

smart box

routers

os command injection

diagnostics

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.563

Percentile

97.7%

JSON

Beeline Smart Box 2.0.38 routers allow “Advanced settings > Other > Diagnostics” OS command injection via the Ping ping_ipaddr parameter, the Nslookup nslookup_ipaddr parameter, or the Traceroute traceroute_ipaddr parameter.

Affected configurations

Nvd

Node

beelinesmart_box_firmwareMatch2.0.38

AND

beelinesmart_boxMatch-

VendorProductVersionCPE
beelinesmart_box_firmware2.0.38cpe:2.3:o:beeline:smart_box_firmware:2.0.38:*:*:*:*:*:*:*
beelinesmart_box-cpe:2.3:h:beeline:smart_box:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
beeline	smart_box_firmware	2.0.38	cpe:2.3:o:beeline:smart_box_firmware:2.0.38:::::::*
beeline	smart_box	-	cpe:2.3:h:beeline:smart_box:-:::::::*

References

medium.com/%40Pavel.Step/security-analysis-of-the-smart-box-router-932f86dc8a9e

yadi.sk/i/iIUCJVaGEuSaAw

yadi.sk/i/jXV87yn4ZJfSHA

yadi.sk/i/YdfXr-ofAN2ZWA

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.563

Percentile

97.7%

JSON

Related for CVE-2020-12246