PT-2020-9631 · Billion · Billion Smart Energy Router Sg600R2

Mario Bartolomé · Published 2020-01-09 · Updated 2020-08-24 · CVE-2019-14920

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Billion Smart Energy Router SG600R2 Firmware version 3.02.rc6

Description The issue allows an authenticated attacker to gain root execution privileges over the device. This is achieved through a hidden shell feature in etc ro/web/adm/system command.asp.

Recommendations For Billion Smart Energy Router SG600R2 Firmware version 3.02.rc6, consider restricting access to the system command.asp feature until a patch is available. As a temporary workaround, limit the use of the affected firmware to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2019-14920

Affected Products

Billion Smart Energy Router Sg600R2

References · 3

• 🔥 https://github.com/InnotecSystem/Device-Reversing/wiki/Firmware-Inspection · Exploit
• https://osv.dev/vulnerability/CVE-2019-14920 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-14920 · Security Note