PT-2022-8684 · Optilink · Optilink Op-Xt71000N

Disguised_Noob + 1 · Published 2022-11-23 · Updated 2022-11-23 · CVE-2020-23591

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OPTILINK OP-XT71000N Hardware Version: V2.2, Firmware Version: OP V3.3.1-191028

Description A vulnerability allows an attacker to upload arbitrary files through "/mgm dev upgrade.asp" which can delete every file for Denial of Service (using rm -rf *.* in the code), establish a reverse connection (using .asp webshell), or create a backdoor.

Recommendations For OPTILINK OP-XT71000N Hardware Version: V2.2, Firmware Version: OP V3.3.1-191028, consider disabling access to the "/mgm dev upgrade.asp" endpoint until a patch is available to prevent arbitrary file uploads. Restrict the use of the rm command and monitor for suspicious .asp webshell activity to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2020-23591

Affected Products

Optilink Op-Xt71000N

References · 5

• 🔥 https://github.com/huzaifahussain98/CVE-2020-23591 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-23591 · Security Note
• https://osv.dev/vulnerability/CVE-2020-23591 · Vendor Advisory
• https://t.me/cvenotify/38286 · Telegram Post
• https://t.me/cibsecurity/53394 · Telegram Post