Lucene search

[email protected]CVE-2020-8958

HistoryJul 15, 2020 - 9:15 p.m.

CVE-2020-8958

2020-07-1521:15:00

CWE-78

[email protected]

web.nvd.nist.gov

In Wild

cve-2020-8958

guangzhou

onu

v2801rw

v2804rgw

remote attackers

os commands

security vulnerability

nvd

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

7.5 High

AI Score

Confidence

High

9 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

0.771 High

EPSS

Percentile

98.2%

JSON

Guangzhou 1GE ONU V2801RW 1.9.1-181203 through 2.9.0-181024 and V2804RGW 1.9.1-181203 through 2.9.0-181024 devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the boaform/admin/formPing Dest IP Address field.

CPENameOperatorVersion
gpononu:1ge_router_wifi_onu_v2801rw_firmwaregpononu 1ge router wifi onu v2801rw firmwarele2.9.0-181024
gpononu:1ge\+3fe\+wifi_onu_v2804rgw_firmwaregpononu 1ge\+3fe\+wifi onu v2804rgw firmwarele2.9.0-181024

CPE	Name	Operator	Version
gpononu:1ge_router_wifi_onu_v2801rw_firmware	gpononu 1ge router wifi onu v2801rw firmware	le	2.9.0-181024
gpononu:1ge\+3fe\+wifi_onu_v2804rgw_firmware	gpononu 1ge\+3fe\+wifi onu v2804rgw firmware	le	2.9.0-181024

References

github.com/qurbat/gpon

www.gpononu.com/dual-mode-onu/1GE-Router-WiFi-ONU.html

www.gpononu.com/gpon-ont/4ge-epon-onu-v2804ew.html

www.karansaini.com/os-command-injection-v-sol/

Social References

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

7.5 High

AI Score

Confidence

High

9 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

0.771 High

EPSS

Percentile

98.2%

JSON

Related for CVE-2020-8958

prion1 attackerkb1 githubexploit2 threatpost1