high8.1
CVE-2020-7982
An issue was discovered in OpenWrt 18.06.0 to 18.06.6 and 19.07.0, and LEDE 17.01.0 to 17.01.7.
Impact
An issue was discovered in OpenWrt 18.06.0 to 18.06.6 and 19.07.0, and LEDE 17.01.0 to 17.01.7. A bug in the fork of the opkg package manager before 2020-01-25 prevents correct parsing of embedded checksums in the signed repository index, allowing a man-in-the-middle attacker to inject arbitrary package payloads (which are installed without verification).
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Openwrt | Lede | from 17.01.0 through 17.01.7 |
| Openwrt | Openwrt | from 18.06.0 before 18.06.7 Version 19.07.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://arstechnica.com/information-technology/2020/03/openwrt-is-vulnerable-to-attacks-that-execute-malicious-code/
- https://blog.forallsecure.com/uncovering-openwrt-remote-code-execution-cve-2020-7982
- https://github.com/openwrt/openwrt/commits/master
- https://openwrt.org/advisory/2020-01-31-1
- https://arstechnica.com/information-technology/2020/03/openwrt-is-vulnerable-to-attacks-that-execute-malicious-code/
- https://blog.forallsecure.com/uncovering-openwrt-remote-code-execution-cve-2020-7982
- https://github.com/openwrt/openwrt/commits/master
- https://openwrt.org/advisory/2020-01-31-1