CVE-2020-15357

Network Analysis functionality in Askey AP5100W_Dual_SIG_1.01.097 and all prior versions allows remote attackers to execute arbitrary commands via a shell…

published December 11, 2020

CVSS
—
EPSS
4%
Percentile
91.0
In the wild
Unconfirmed
What it is

⚠️ A crafty use of shell metacharacters can turn your Askey AP5100W into an attacker's playground! 😱 Think of this vulnerability as a restaurant that lets diners add secret ingredients to their meals without checking the recipe. One simple request could result in an unexpected dish that even the chef wouldn’t approve of! With this vulnerability, an attacker could execute arbitrary commands on the device, potentially leading to unauthorized access and control. It’s like giving someone the chef's hat and letting them run the kitchen unsupervised!

Put simply

Think of this vulnerability as a restaurant that lets diners add secret ingredients to their meals without checking the recipe. One simple request could result in an unexpected dish that even the chef wouldn’t approve of! This vulnerability in the Network Analysis functionality allows attackers to inject malicious commands via shell metacharacters in the ping, traceroute, or route options, compromising the device's security.

What to do

With this vulnerability, an attacker could execute arbitrary commands on the device, potentially leading to unauthorized access and control. It’s like giving someone the chef's hat and letting them run the kitchen unsupervised! To secure your Askey AP5100W, update to the latest firmware version that addresses this vulnerability. Review and restrict device access to trusted users only, and monitor network activity for any unusual commands. You've got this! Secure your network and keep those pesky attackers at bay! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.04263 · 91.0th percentile
Published
2020-12-11T15:22Z
EPSS history
Timeline
  • 11 DEC 15:22Z
    Network Analysis functionality in Askey AP5100W_Dual_SIG_1.01.097 and all prior versions allows remote attackers to execute arbitrary commands via a shell…
    cvelistv5