PT-2020-13070 · Beeline · Beeline Smart Box

Published 2020-04-29 · Updated 2020-05-07 · CVE-2020-12246

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Beeline Smart Box version 2.0.38

Description The issue allows OS command injection via the "Advanced settings > Other > Diagnostics" feature. Specifically, it affects the ping ipaddr parameter in the Ping function, the nslookup ipaddr parameter in the Nslookup function, or the traceroute ipaddr parameter in the Traceroute function.

Recommendations For Beeline Smart Box version 2.0.38, as a temporary workaround, consider restricting access to the "Advanced settings > Other > Diagnostics" feature until a patch is available. Avoid using the ping ipaddr, nslookup ipaddr, and traceroute ipaddr parameters in the affected functions to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2020-12246

Affected Products

Beeline Smart Box

References · 8

• 🔥 https://yadi.sk/i/YdfXr-ofAN2ZWA · Exploit
• 🔥 https://yadi.sk/i/jXV87yn4ZJfSHA · Exploit
• 🔥 https://yadi.sk/i/iIUCJVaGEuSaAw · Exploit
• 🔥 https://medium.com/@Pavel.Step/security-analysis-of-the-smart-box-router-932f86dc8a9e · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-12246 · Security Note
• https://osv.dev/vulnerability/CVE-2020-12246 · Vendor Advisory
• https://t.me/cvenotify/3387 · Telegram Post
• https://medium.com/%40Pavel.Step/security-analysis-of-the-smart-box-router-932f86dc8a9e · Note