PT-2020-16765 · Relish · Vh510

Published 2020-11-04 · Updated 2020-11-10 · CVE-2020-27689

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Relish (Verve Connect) VH510 device with firmware prior to 1.0.1.6L0516

Description The issue concerns undocumented default admin credentials for the web management interface. A remote attacker could exploit this to login and execute commands on the device, as well as upgrade the firmware image to a malicious version.

Recommendations For firmware versions prior to 1.0.1.6L0516, update the firmware to version 1.0.1.6L0516 or later to resolve the issue. As a temporary workaround, consider changing the default admin credentials to prevent unauthorized access. Restrict access to the web management interface to minimize the risk of exploitation.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2020-27689

Affected Products

Vh510

References · 4

• 🔥 https://6point6.co.uk/wp-content/uploads/2020/10/Relish-4G-VH510-Hub-Full-Disclosure-v1.3.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-27689 · Security Note
• https://osv.dev/vulnerability/CVE-2020-27689 · Vendor Advisory
• https://6point6.co.uk/insights/security-advisory-relish-4g-hub-vh510 · Note