CVE-2020-7242

Comtech Stampede FX-1010 7.4.3 devices allow remote authenticated administrators to achieve remote code execution by navigating to the Diagnostics Trace Route page and entering shell metacharacters in the Target IP address field. (In some cases, authentication can be achieved with the comtech password for the comtech account.)

CVSS v3.1

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C

EPSS

4.42% chance of exploitation in the next 30 days, 91th percentile

Published

2020-01-20

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://sku11army.blogspot.com/2020/01/comtech-authenticated-rce-on-comtech.html

References

• CVE Record
• NVD entry

Related

• CVE-2020-7241
• CVE-2020-7246
• CVE-2020-7240
• CVE-2020-7247
• CVE-2020-7234
• CVE-2020-7249