An issue was discovered in includes/webconsole.php in RaspAP 2.5. With authenticated access, an attacker can use a misconfigured (and virtually unrestricted) web console to attack the underlying OS (Raspberry Pi) running this software, and execute commands on the system (including ones for uploading of files and execution of code).
References
| Link | Resource |
|---|---|
| https://deadb0x.io/lunchb0x/cve-2020-24572/ | Exploit Third Party Advisory |
| https://github.com/billz/raspap-webgui/commit/dd5ab7bdc213381ee552001dd80c41ca47afab00 | Patch Third Party Advisory |
| https://github.com/billz/raspap-webgui/releases | Release Notes Third Party Advisory |
| https://github.com/lb0x | Third Party Advisory |
| https://deadb0x.io/lunchb0x/cve-2020-24572/ | Exploit Third Party Advisory |
| https://github.com/billz/raspap-webgui/commit/dd5ab7bdc213381ee552001dd80c41ca47afab00 | Patch Third Party Advisory |
| https://github.com/billz/raspap-webgui/releases | Release Notes Third Party Advisory |
| https://github.com/lb0x | Third Party Advisory |
Configurations
History
21 Nov 2024, 05:15
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://deadb0x.io/lunchb0x/cve-2020-24572/ - Exploit, Third Party Advisory | |
| References | () https://github.com/billz/raspap-webgui/commit/dd5ab7bdc213381ee552001dd80c41ca47afab00 - Patch, Third Party Advisory | |
| References | () https://github.com/billz/raspap-webgui/releases - Release Notes, Third Party Advisory | |
| References | () https://github.com/lb0x - Third Party Advisory |
Information
Published : 2020-08-24 20:15
Updated : 2024-11-21 05:15
NVD link : CVE-2020-24572
Mitre link : CVE-2020-24572
CVE.ORG link : CVE-2020-24572
JSON object : View
Products Affected
raspap
- raspap
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')