CVE-2020-13976 Command injection in n/a
Remote attackers with administrative privileges can execute arbitrary commands via shell metacharacters in the ping diagnostic tool on DD-WRT routers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-13976?
CVE-2020-13976 is a high-severity command injection vulnerability in n/a, published on 9 Jun 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An issue was discovered in DD-WRT through 16214. The Diagnostic page allows remote attackers to execute arbitrary commands via shell metacharacters in the host field of the ping command. Exploitation through CSRF might be possible. NOTE: software maintainers consider the report invalid because it refers to an old software version, requires administrative privileges, and does not provide access beyond that already available to administrative users
Weakness: CWE-78
Which versions are affected by CVE-2020-13976?
It affects 1 product.
Products include Dd-Wrt Dd-Wrt.
How do I fix CVE-2020-13976?
No fix has been published for CVE-2020-13976 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2020-13976 being exploited?
There is no known exploitation of CVE-2020-13976 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-6cm3-3v62-g64q.