CVE-2020-24365
high · 8.8An issue was discovered on Gemtek WRTM-127ACN 01.01.02.141 and WRTM-127x9 01.01.02.127 devices. The Monitor Diagnostic network page allows an authenticated attacker to execute a command directly on the target machine. Commands are executed as the root user (uid 0). (Even if a login is required, most routers are left with default credentials.)
8.8
CVSS
11.4%
EPSS (exploit prob.)
96th
EPSS percentile
2020-09-24
Published
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78CWE-1188
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| gemteks | wrtm-127acn_firmware | 01.01.02.141 |
| gemteks | wrtm-127acn | all versions |
| gemteks | wrtm-127x9_firmware | 01.01.02.127 |
| gemteks | wrtm-127x9 | all versions |
Check a specific version with /api/v1/cve/match.
References
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2020-24365