Lucene search

MitreCVE-2020-24572

HistoryAug 24, 2020 - 8:15 p.m.

CVE-2020-24572

2020-08-2420:15:10

CWE-78

mitre

web.nvd.nist.gov

cve-2020-24572

raspap

webconsole.php

authenticated access

os attack

raspberry pi

command execution

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.7

Confidence

High

EPSS

0.005

Percentile

76.9%

JSON

An issue was discovered in includes/webconsole.php in RaspAP 2.5. With authenticated access, an attacker can use a misconfigured (and virtually unrestricted) web console to attack the underlying OS (Raspberry Pi) running this software, and execute commands on the system (including ones for uploading of files and execution of code).

Affected configurations

Nvd

Node

raspapraspapMatch2.5

VendorProductVersionCPE
raspapraspap2.5cpe:2.3:a:raspap:raspap:2.5:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
raspap	raspap	2.5	cpe:2.3:a:raspap:raspap:2.5:::::::*

References

deadb0x.io/lunchb0x/cve-2020-24572/

github.com/billz/raspap-webgui/commit/dd5ab7bdc213381ee552001dd80c41ca47afab00

github.com/billz/raspap-webgui/releases

github.com/lb0x

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.7

Confidence

High

EPSS

0.005

Percentile

76.9%

JSON

Related for CVE-2020-24572