Remote Code Execution Vulnerability in Netis WF2471 Router
CVE-2020-8946

8.8HIGH

Key Information:

Vendor

Netis-systems

Status
Wf2471 Firmware
Vendor
CVE Published:
12 February 2020

What is CVE-2020-8946?

The Netis WF2471 router version 1.2.30142 is vulnerable to a remote code execution flaw that allows an authenticated attacker to execute arbitrary operating system commands. This vulnerability arises from improper handling of the log_3g_type parameter in the /cgi-bin-igd/sys_log_clean.cgi interface. By exploiting this flaw, an attacker could craft malicious requests that include shell metacharacters, potentially leading to unauthorized control over the device's operating system.

References

https://sku11army.blogspot.com/2020/02/netis-authenticate...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2020-8946 : Remote Code Execution Vulnerability in Netis WF2471 Router