CVE-2020-24572
 
Severity Score
8.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
2
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
An issue was discovered in includes/webconsole.php in RaspAP 2.5. With authenticated access, an attacker can use a misconfigured (and virtually unrestricted) web console to attack the underlying OS (Raspberry Pi) running this software, and execute commands on the system (including ones for uploading of files and execution of code).
Se detectó un problema en el archivo includes/webconsole.php en RaspAP versión 2.5. Con acceso autenticado, un atacante puede usar una consola web mal configurada (y virtualmente sin restricciones) para atacar el Sistema Operativo subyacente (Raspberry Pi) que ejecuta este software y ejecuta comandos en el sistema (incluyendo los de carga de archivos y ejecución de código).
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2020-08-21 CVE Reserved
- 2020-08-24 CVE Published
- 2021-04-01 First Exploit
- 2024-08-04 CVE Updated
- 2024-08-31 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CAPEC
References (5)
URL | Tag | Source |
---|---|---|
https://github.com/billz/raspap-webgui/releases | Release Notes | |
https://github.com/lb0x | Third Party Advisory |
URL | Date | SRC |
---|---|---|
https://github.com/gerbsec/CVE-2020-24572-POC | 2021-04-01 | |
https://deadb0x.io/lunchb0x/cve-2020-24572 | 2024-08-04 |
URL | Date | SRC |
---|---|---|
https://github.com/billz/raspap-webgui/commit/dd5ab7bdc213381ee552001dd80c41ca47afab00 | 2020-09-01 |
URL | Date | SRC |
---|