CVE-2020-28695

Askey Fiber Router RTF3505VW-N1 BR_SV_g000_R3505VWN1001_s32_7 devices allow Remote Code Execution and retrieval of admin credentials to log into the Dashboard or login via SSH, leading to code execution as root.

CVSS v3 8.8 HIGH
CVSS v2.0 8.3 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

8.3^/10

CVSS v2.0 : HIGH

Vector : AV:A/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 6.5 / Impact : 10.0

Access Vector ADJACENT_NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://cr1pt0.medium.com/cve-2020-28695-8f8d618ac0b	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:askey:rtf3505vw-n1_br_sv_g000_r3505vwn1001_s32_7_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:askey:rtf3505vw-n1_br_sv_g000_r3505vwn1001_s32_7:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2021-03-26 18:15

Updated : 2024-02-28 18:28

NVD link : CVE-2020-28695

Mitre link : CVE-2020-28695

CVE.ORG link : CVE-2020-28695

JSON object : View

Products Affected

askey

rtf3505vw-n1_br_sv_g000_r3505vwn1001_s32_7
rtf3505vw-n1_br_sv_g000_r3505vwn1001_s32_7_firmware

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2020-28695", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 8.3, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 6.5, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2021-03-26T18:15:12.030", "references": [{"url": "https://cr1pt0.medium.com/cve-2020-28695-8f8d618ac0b", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Askey Fiber Router RTF3505VW-N1 BR_SV_g000_R3505VWN1001_s32_7 devices allow Remote Code Execution and retrieval of admin credentials to log into the Dashboard or login via SSH, leading to code execution as root."}, {"lang": "es", "value": "Los dispositivos Askey Fiber Router RTF3505VW-N1 versi\u00f3n BR_SV_g000_R3505VWN1001_s32_7, permiten una Ejecuci\u00f3n de C\u00f3digo Remota y una recuperaci\u00f3n de credenciales de administrador para iniciar sesi\u00f3n en el Panel o iniciar sesi\u00f3n por medio de SSH, conllevando a una ejecuci\u00f3n del c\u00f3digo como root."}], "lastModified": "2022-07-12T17:42:04.277", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:askey:rtf3505vw-n1_br_sv_g000_r3505vwn1001_s32_7_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5D1F3C6A-2BB8-45FC-A9AB-AA420E096BBD"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:askey:rtf3505vw-n1_br_sv_g000_r3505vwn1001_s32_7:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "4ED5568F-D7A9-4D6B-A5CC-9EA503F9EC0A"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}