CVE-2020-5179

Comtech Stampede FX-1010 7.4.3 devices allow remote authenticated administrators to execute arbitrary OS commands by navigating to the Diagnostics Ping page and entering shell metacharacters in the Target IP address field. (In some cases, authentication can be achieved with the comtech password for the comtech account.)

CVSS v3.1

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C

EPSS

2.84% chance of exploitation in the next 30 days, 86th percentile

Published

2020-01-01

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://sku11army.blogspot.com/2020/01/comtech-authenticated-rce-on-comtech-fx.html

References

• CVE Record
• NVD entry

Related

• CVE-2020-5147
• CVE-2020-5183
• CVE-2020-5142
• CVE-2020-5186
• CVE-2020-5014
• CVE-2020-5187