Lucene search

PRIOn knowledge basePRION:CVE-2020-8958

HistoryJul 15, 2020 - 9:15 p.m.

Design/Logic Flaw

2020-07-1521:15:00

PRIOn knowledge base

www.prio-n.com

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

7.5 High

AI Score

Confidence

High

9 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

0.771 High

EPSS

Percentile

98.1%

JSON

Guangzhou 1GE ONU V2801RW 1.9.1-181203 through 2.9.0-181024 and V2804RGW 1.9.1-181203 through 2.9.0-181024 devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the boaform/admin/formPing Dest IP Address field.

CPENameOperatorVersion
1ge\\+3fe\\+wifi_onu_v2804rgw_firmwareeq>= 1.9.1181203 AND <= 2.9.0181024
1ge_router_wifi_onu_v2801rw_firmwareeq>= 1.9.1181203 AND <= 2.9.0181024

CPE	Name	Operator	Version
	1ge\\+3fe\\+wifi_onu_v2804rgw_firmware	eq	>= 1.9.1181203 AND <= 2.9.0181024
	1ge_router_wifi_onu_v2801rw_firmware	eq	>= 1.9.1181203 AND <= 2.9.0181024

References

github.com/qurbat/gpon

www.gpononu.com/dual-mode-onu/1GE-Router-WiFi-ONU.html

www.gpononu.com/gpon-ont/4ge-epon-onu-v2804ew.html

www.karansaini.com/os-command-injection-v-sol/

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

7.5 High

AI Score

Confidence

High

9 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

0.771 High

EPSS

Percentile

98.1%

JSON

Related for PRION:CVE-2020-8958