PT-2020-12957 · Openwrt+2 · Openwrt+2

Ilya Shaposhnikov · Published 2020-04-21 · Updated 2024-08-04 · CVE-2020-11966

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IQrouter versions 3.3.1 and earlier

Description The issue allows remote attackers to change the root password arbitrarily using the Lua function reset password in the web-panel. This can occur on a brand-new network that has not been configured with a secure password. It is noted that this behavior is also seen in unconfigured releases of OpenWRT and other new Linux distributions prior to their initial configuration.

Recommendations For IQrouter versions 3.3.1 and earlier, as a temporary workaround, consider disabling the reset password function in the web-panel until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-521

Related Identifiers

CVE-2020-11966

Affected Products

Iqrouter

Linux

Openwrt

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2020-11966 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11966 · Vendor Advisory
• https://pastebin.com/grSCSBSu · Note
• https://openwrt.org/docs/guide-quick-start/walkthrough_login · Note
• https://t.me/cvenotify/88964 · Telegram Post
• https://evenroute.com · Note
• https://evenroute.zendesk.com/hc/en-us/articles/216107838-How-do-I-configure-an-IQrouter- · Note
• https://t.me/cvenotify/2957 · Telegram Post