PT-2020-20395 · V Sol+1 · V-Sol Home Routers+2

Published

2020-07-15

·

Updated

2024-12-19

·

CVE-2020-8958

CVSS v2.0

9.0

High

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Guangzhou 1GE ONU V2801RW versions 1.9.1-181203 through 2.9.0-181024 Guangzhou 1GE ONU V2804RGW versions 1.9.1-181203 through 2.9.0-181024 V-SOL Home Routers (affected versions not specified)
Description The issue allows remote attackers to execute arbitrary OS commands via shell metacharacters in the boaform/admin/formPing Dest IP Address field. This command injection vulnerability is gaining attention and has been observed in a significant portion of traffic, with 8 IPs composing nearly 50% of observed traffic.
Recommendations For Guangzhou 1GE ONU V2801RW versions 1.9.1-181203 through 2.9.0-181024, restrict access to the boaform/admin/formPing endpoint to minimize the risk of exploitation. For Guangzhou 1GE ONU V2804RGW versions 1.9.1-181203 through 2.9.0-181024, avoid using the Dest IP Address field in the boaform/admin/formPing endpoint until the issue is resolved. For V-SOL Home Routers, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-04924
CVE-2020-8958

Affected Products

Guangzhou 1Ge Onu V2801Rw
Guangzhou 1Ge Onu V2804Rgw
V-Sol Home Routers