CVE-2019-20348

OKER G232V1 v1.03.02.20161129 devices provide a root terminal on a UART serial interface without proper access control. This allows attackers with physical access to interrupt the boot sequence in order to execute arbitrary commands with root privileges and conduct further attacks.

CVSS v3.1

6.8 MEDIUMCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C

EPSS

0.56% chance of exploitation in the next 30 days, 44th percentile

Published

2020-01-06

Updated

2024-08-05

Proof-of-concept exploits (1)

• https://gist.github.com/tanprathan/24cab2eb02937f86961c6380b47ce385

References

• CVE Record
• NVD entry

Related

• CVE-2019-20334
• CVE-2019-20352
• CVE-2019-20326
• CVE-2019-20354
• CVE-2019-2025
• CVE-2019-20357