CVE-2020-7594

MultiTech Conduit MTCDT-LVW2-24XX 1.4.17-ocea-13592 devices allow remote authenticated administrators to execute arbitrary OS commands by navigating to the Debug Options page and entering shell metacharacters in the interface JSON field of the ping function.

CVSS v3.1

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C

EPSS

2.49% chance of exploitation in the next 30 days, 84th percentile

Published

2020-01-21

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://sku11army.blogspot.com/2020/01/multitech-authenticated-remote-code.html

References

• CVE Record
• NVD entry

Related

• CVE-2020-7593
• CVE-2020-7596
• CVE-2020-7473
• CVE-2020-7597
• CVE-2020-7471
• CVE-2020-7598