CVE-2020-21883 — HIGH (8.8)

Vulnerability Description

Unibox U-50 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain a OS command injection vulnerability in /tools/ping, which can leads to complete device takeover.

CVSS Score

8.8

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Indionetworks	Unibox U50 Firmware	2.4
Indionetworks	Unibox U50	-
Indionetworks	Unibox U500 Firmware	2.4
Indionetworks	Unibox U500	-
Indionetworks	Unibox U1000 Firmware	2.4
Indionetworks	Unibox U1000	-
Indionetworks	Unibox U2500 Firmware	2.4
Indionetworks	Unibox U2500	-
Indionetworks	Unibox U5000 Firmware	2.4
Indionetworks	Unibox U5000	-

Related Weaknesses (CWE)

CWE-78

References

http://wifi-soft.comVendor Advisory
https://s3curityb3ast.github.io/KSA-Dev-009.txtExploitThird Party Advisory
https://www.mail-archive.com/fulldisclosure%40seclists.org/msg07140.html
http://wifi-soft.comVendor Advisory
https://s3curityb3ast.github.io/KSA-Dev-009.txtExploitThird Party Advisory
https://www.mail-archive.com/fulldisclosure%40seclists.org/msg07140.html

FAQ

What is CVE-2020-21883?

CVE-2020-21883 is a vulnerability with a CVSS score of 8.8 (HIGH). Unibox U-50 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain a OS command injection vulnerability in /tools/ping, which can leads to complete device takeover.

How severe is CVE-2020-21883?

CVE-2020-21883 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-21883?

Check the references section above for vendor advisories and patch information. Affected products include: Indionetworks Unibox U50 Firmware, Indionetworks Unibox U50, Indionetworks Unibox U500 Firmware, Indionetworks Unibox U500, Indionetworks Unibox U1000 Firmware.