Vulnerability · Published Nov 5, 2020 · Assigned by mitre

CVE-2020-24849

High 8.8

In plain English

A high-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.3% (higher than 89% of all known vulnerabilities).

Severity (CVSS NVD)8.8High

Exploit odds (30 days)3.3%top 11.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A remote code execution vulnerability is identified in FruityWifi through 2.4. Due to improperly escaped shell metacharacters obtained from the POST request at the page_config_adv.php page, it is possible to perform remote code execution by an authenticated attacker. This is similar to CVE-2018-17317.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

http://fruitywifi.com/index_eng.html x_refsource_MISC
https://github.com/xtr4nge/FruityWifi x_refsource_MISC
https://gist.github.com/harsh-bothra/f899045b16bbba264628d79d52c07c22 x_refsource_MISC