PT-2020-13995 · Remedia It · Nedi

Farid007 · Published 2020-06-29 · Updated 2020-07-06 · CVE-2020-14414

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions NeDi version 1.9C

Description The issue allows for Remote Command Execution due to improper escaping of shell metacharacters from a POST request in the pwsec.php file. An attacker can exploit this by sending a crafted payload containing shell metacharacters via a POST request with the pw parameter. This can also be exploited through Cross-Site Request Forgery (CSRF).

Recommendations For NeDi version 1.9C, as a temporary workaround, consider restricting access to the pwsec.php file to minimize the risk of exploitation. Avoid using the pw parameter in the affected POST request until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2020-14414

Affected Products

Nedi

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2020-14414 · Security Note
• https://osv.dev/vulnerability/CVE-2020-14414 · Vendor Advisory
• https://gist.github.com/farid007/a3d96d305f028d221f729eb6ae681f5a · Note