PT-2021-9839 · Mofi Network · Mofi4500-4Gxelte

Published 2021-02-01 · Updated 2021-02-03 · CVE-2020-15835

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mofi Network MOFI4500-4GXeLTE version 4.1.5-std

Description An issue was discovered in the authentication function, which contains undocumented code allowing authentication as root without knowing the actual root password. An adversary with the private key can remotely authenticate to the management interface as root.

Recommendations For Mofi Network MOFI4500-4GXeLTE version 4.1.5-std, consider disabling remote access to the management interface until a patch is available to prevent exploitation of the undocumented code in the authentication function. Restrict access to the management interface to minimize the risk of unauthorized root access.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2020-15835

Affected Products

Mofi4500-4Gxelte

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-15835 · Security Note
• https://mofinetwork.com/index.php?main_page=page&id=14 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15835 · Vendor Advisory
• https://t.me/cvenotify/9220 · Telegram Post
• https://t.me/cvenotify/9202 · Telegram Post
• https://criticalstart.com/critical-vulnerabilities-discovered-in-mofi-routers · Note
• https://t.me/cvenotify/9368 · Telegram Post