high8.8Public exploit code
CVE-2020-24365
An issue was discovered on Gemtek WRTM-127ACN 01.01.02.141 and WRTM-127x9 01.01.02.127 devices.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Gemtek WVRTM-127ACN 01.01.02.141 - Authenticated Arbitrary Command Injection2020-11-19 · webapps · cgi
Impact
An issue was discovered on Gemtek WRTM-127ACN 01.01.02.141 and WRTM-127x9 01.01.02.127 devices. The Monitor Diagnostic network page allows an authenticated attacker to execute a command directly on the target machine. Commands are executed as the root user (uid 0). (Even if a login is required, most routers are left with default credentials.)
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gemteks | Wrtm-127acn Firmware | Version 01.01.02.141 |
| Gemteks | Wrtm-127x9 Firmware | Version 01.01.02.127 |