PT-2021-9865 · Extreme Networks · Hiveos+1

Published 2021-11-14 · Updated 2021-11-18 · CVE-2020-16152

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine versions through 10.0r8a

Description The NetConfig UI administrative interface allows attackers to execute PHP code as the root user via remote HTTP requests. This is achieved by inserting the PHP code into a log file and then traversing to that file.

Recommendations For versions through 10.0r8a, consider restricting access to the NetConfig UI administrative interface until a patch is available. As a temporary workaround, limit the ability to insert code into log files and restrict file traversal to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-829

Related Identifiers

CVE-2020-16152

Affected Products

Hiveos

Iq Engine

References · 9

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/aerohive_netconfig_lfi_log_poison_rce.rb · Exploit
• 🔥 https://github.com/eriknl/CVE-2020-16152 · Exploit
• 🔥 https://github.com/Nate0634034090/nate158g-m-w-n-l-p-d-a-o-e · Exploit
• 🔥 http://packetstormsecurity.com/files/164957/Aerohive-NetConfig-10.0r8a-Local-File-Inclusion-Remote-Code-Execution.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-16152 · Security Note
• https://osv.dev/vulnerability/CVE-2020-16152 · Vendor Advisory
• https://gtacknowledge.extremenetworks.com/articles/Vulnerability_Notice/VN-2020-001 · Vendor Advisory
• https://t.me/cvenotify/23405 · Telegram Post
• https://t.me/cibsecurity/32393 · Telegram Post