Guangzhou 1GE ONU V2801RW 1.9.1-181203 through 2.9.0-181024 and V2804RGW 1.9.1-181203 through 2.9.0-181024 devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the boaform/admin/formPing Dest IP Address field.
References
| Link | Resource |
|---|---|
| https://github.com/qurbat/gpon | Exploit Third Party Advisory |
| https://www.gpononu.com/dual-mode-onu/1GE-Router-WiFi-ONU.html | Product |
| https://www.gpononu.com/gpon-ont/4ge-epon-onu-v2804ew.html | Product |
| https://www.karansaini.com/os-command-injection-v-sol/ | Exploit Third Party Advisory |
| https://github.com/qurbat/gpon | Exploit Third Party Advisory |
| https://www.gpononu.com/dual-mode-onu/1GE-Router-WiFi-ONU.html | Product |
| https://www.gpononu.com/gpon-ont/4ge-epon-onu-v2804ew.html | Product |
| https://www.karansaini.com/os-command-injection-v-sol/ | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
Configuration 2 (hide)
| AND |
|
History
21 Nov 2024, 05:39
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/qurbat/gpon - Exploit, Third Party Advisory | |
| References | () https://www.gpononu.com/dual-mode-onu/1GE-Router-WiFi-ONU.html - Product | |
| References | () https://www.gpononu.com/gpon-ont/4ge-epon-onu-v2804ew.html - Product | |
| References | () https://www.karansaini.com/os-command-injection-v-sol/ - Exploit, Third Party Advisory |
Information
Published : 2020-07-15 21:15
Updated : 2024-11-21 05:39
NVD link : CVE-2020-8958
Mitre link : CVE-2020-8958
CVE.ORG link : CVE-2020-8958
JSON object : View
Products Affected
gpononu
- 1ge\+3fe\+wifi_onu_v2804rgw_firmware
- 1ge_router_wifi_onu_v2801rw
- 1ge\+3fe\+wifi_onu_v2804rgw
- 1ge_router_wifi_onu_v2801rw_firmware
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')