CVE-2020-7982

An issue was discovered in OpenWrt 18.06.0 to 18.06.6 and 19.07.0, and LEDE 17.01.0 to 17.01.7

published March 16, 2020

CVSS
—
EPSS
2%
Percentile
75.5
In the wild
Unconfirmed
What it is

An issue was discovered in OpenWrt 18.06.0 to 18.06.6 and 19.07.0, and LEDE 17.01.0 to 17.01.7. A bug in the fork of the opkg package manager before 2020-01-25 prevents correct parsing of embedded checksums in the signed repository index, allowing a man-in-the-middle attacker to inject arbitrary package payloads (which are installed without verification).

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01596 · 75.5th percentile
Published
2020-03-16T21:05Z
EPSS history
Timeline
  • 16 MAR 21:05Z
    An issue was discovered in OpenWrt 18.06.0 to 18.06.6 and 19.07.0, and LEDE 17.01.0 to 17.01.7
    cvelistv5