PT-2020-12956 · Openwrt+1 · Openwrt+1

Ilya Shaposhnikov · Published 2020-04-21 · Updated 2024-08-04 · CVE-2020-11965

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IQrouter versions 3.3.1 and earlier

Description The issue allows attackers to gain full remote access via SSH due to a root user without a password. This can occur on a brand-new network that has not been configured, specifically after initiating the forced initial configuration but before setting a secure password on the system. It is noted that this condition is also true for any unconfigured release of OpenWRT and many other new Linux distributions prior to their first configuration.

Recommendations For IQrouter versions 3.3.1 and earlier, set a secure password on the system during the initial configuration to prevent unauthorized access. As a temporary workaround, consider disabling remote SSH access until a secure password is set.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2020-11965

Affected Products

Iqrouter

Openwrt

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2020-11965 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11965 · Vendor Advisory
• https://pastebin.com/grSCSBSu · Note
• https://t.me/cvenotify/2956 · Telegram Post
• https://openwrt.org/docs/guide-quick-start/walkthrough_login · Note
• https://evenroute.com · Note
• https://evenroute.zendesk.com/hc/en-us/articles/216107838-How-do-I-configure-an-IQrouter- · Note
• https://t.me/cvenotify/88963 · Telegram Post