PT-2020-13736 · Mofi Network · Mofi4500-4Gxelte

Published 2020-09-03 · Updated 2021-07-21 · CVE-2020-13856

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mofi Network MOFI4500-4GXeLTE version 4.0.8-std

Description An issue was discovered where authentication is not required to download the support file, which contains sensitive information such as cleartext credentials and password hashes.

Recommendations For Mofi Network MOFI4500-4GXeLTE version 4.0.8-std, consider restricting access to the support file until a patch is available. As a temporary workaround, avoid downloading the support file to minimize the risk of exposing sensitive information. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2020-13856

Affected Products

Mofi4500-4Gxelte

References · 8

• https://osv.dev/vulnerability/CVE-2020-13856 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13856 · Security Note
• https://mofinetwork.com/index.php?main_page=page&id=14 · Vendor Advisory
• https://t.me/cvenotify/9199 · Telegram Post
• https://t.me/cvenotify/9217 · Telegram Post
• https://t.me/cybersecuritytechnologies/1688 · Telegram Post
• https://criticalstart.com/critical-vulnerabilities-discovered-in-mofi-routers · Note
• https://t.me/cvenotify/9369 · Telegram Post