Vulnerability · Published Nov 20, 2020 · Assigned by krcert
CVE-2020-7842D'live AP command injection vulnerability
Medium 6.4
In plain English
A medium-severity improper input validation in D'live set-top box AP(WF2429TB) from Netis Korea. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 75% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 3.1)6.4Medium
Exploit odds (30 days)1.6%top 24.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
Improper Input validation vulnerability exists in Netis Korea D'live AP which could cause arbitrary command injection and execution when the time setting (using ntpServerlp1 parameter) for the users. This affects D'live set-top box AP(WF2429TB) v1.1.10.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Netis Korea | D'live set-top box AP(WF2429TB) | 1.1.10 – through 1.1.10 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35797 x_refsource_CONFIRM