high8.8
CVE-2018-20487
An issue was discovered in the firewall3 component in Inteno IOPSYS 1.0 through 3.16.
Impact
An issue was discovered in the firewall3 component in Inteno IOPSYS 1.0 through 3.16. The attacker must make a JSON-RPC method call to add a firewall rule as an "include" and point the "path" argument to a malicious script or binary. This gets executed as root when the firewall changes are committed.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Inteno | Iopsys | from 1.0 through 3.16 |
Weakness classification
References
- NVD record
- CVE.org record
- http://public.inteno.se/?p=feed-inteno-openwrt.git%3Ba=commit%3Bh=e6159ca928d7f0c143be213afc6bf810c0329fe2
- https://neonsea.uk/blog/2018/12/26/firewall-includes.html
- http://public.inteno.se/?p=feed-inteno-openwrt.git%3Ba=commit%3Bh=e6159ca928d7f0c143be213afc6bf810c0329fe2
- https://neonsea.uk/blog/2018/12/26/firewall-includes.html