PT-2021-9836 · Mofi Network · Mofi4500-4Gxelte

Published 2021-02-01 · Updated 2021-02-04 · CVE-2020-15832

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Mofi Network MOFI4500-4GXeLTE version 4.1.5-std

Description An issue was discovered in the poof.cgi script, which contains undocumented code allowing remote reboot of the device. An adversary with the private key, but not the root password, can exploit this to remotely reboot the device.

Recommendations For Mofi Network MOFI4500-4GXeLTE version 4.1.5-std, consider disabling the poof.cgi script as a temporary workaround until a patch is available. Restrict access to the private key to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2020-15832

Affected Products

Mofi4500-4Gxelte

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-15832 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15832 · Vendor Advisory
• https://mofinetwork.com/index.php?main_page=page&id=14 · Vendor Advisory
• https://criticalstart.com/critical-vulnerabilities-discovered-in-mofi-routers · Note
• https://t.me/cvenotify/9201 · Telegram Post
• https://t.me/cvenotify/9219 · Telegram Post