PT-2020-12958 · Openwrt+1 · Openwrt+1

Ilya Shaposhnikov · Published 2020-04-21 · Updated 2024-08-04 · CVE-2020-11967

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IQrouter versions 3.3.1 and earlier

Description The issue allows remote attackers to control the device, enabling actions such as restarting the network, rebooting, upgrading, or resetting, due to incorrect access control. This issue is relevant to brand-new networks, particularly before the initial configuration is completed and a secure password is set. It is also a common issue in unconfigured releases of OpenWRT and other new Linux distributions prior to their first configuration.

Recommendations For IQrouter versions 3.3.1 and earlier, as a temporary workaround, consider restricting access to the device until a secure password is set during the initial configuration. Ensure that the initial configuration step for setting a secure password on the system is completed to mitigate the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2020-11967

Affected Products

Iqrouter

Openwrt

References · 9

• https://osv.dev/vulnerability/CVE-2020-11967 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11967 · Security Note
• https://pastebin.com/grSCSBSu · Note
• https://t.me/cvenotify/84557 · Telegram Post
• https://openwrt.org/docs/guide-quick-start/walkthrough_login · Note
• https://t.me/cvenotify/88965 · Telegram Post
• https://evenroute.com · Note
• https://t.me/cvenotify/2958 · Telegram Post
• https://evenroute.zendesk.com/hc/en-us/articles/216107838-How-do-I-configure-an-IQrouter- · Note