CVE-2020-24849

FruityWifi up to version 2.4 is affected by a Shell Metacharacter Injection vulnerability. Red Hat CVE-2018-19168 describes exploitation in www/modules/save.php via a crafted mod_name in a POST request, enabling remote code execution with root privileges. The root cause is improper escaping of sh...

CVE-2018-17317

CVE-2018-17317: FruityWifi is affected by remote command execution via shell metacharacters in numerous parameters (io_mode, ap_mode, io_action, io_in_, iface, domain, newSSID, hostapd_ and supplicant_ssid) sent to /www/script/config_iface.php or /www/page_config.php. This enables an attacker to ...

CVE-2020-24847

FruityWifi (versions up to 2.4) is affected by a Cross-Site Request Forgery (CSRF) due to missing CSRF protection in page_config_adv.php. An unauthenticated attacker can lure a victim to a malicious site and cause changes to the device’s network configuration, specifically the newSSID and hostapd...

CVE-2018-19168

FruityWifi (PatatasFritas/PatataWifi)

CVE-2020-24848

CVE-2020-24848 affects FruityWifi up to version 2.4, where an unsafe sudo configuration (ALL: ALL) NOPASSWD: ALL enables local root privilege escalation. This misconfiguration allows an attacker with local access to obtain full persistent control over the system. Publicly documented sources (incl...