CVE-2020-23583 Command injection in n/a

Critical 9.8 Published 23 Nov 2022 Updated 25 Apr 2025

Remote attackers can execute arbitrary commands via the PingTest interface, leading to full system compromise on OPTILINK routers.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-23583?

CVE-2020-23583 is a critical command injection vulnerability in n/a, published on 23 Nov 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

OPTILINK OP-XT71000N V2.2 is vulnerable to Remote Code Execution. The issue occurs when the attacker sends an arbitrary code on "/diag_ping_admin.asp" to "PingTest" interface that leads to COMMAND EXECUTION. An attacker can successfully trigger the COMMAND and can compromise full system.

Weakness: CWE-77

Which versions are affected by CVE-2020-23583?

It affects 1 product.

Products include Optilinknetwork Op-Xt71000n Firmware.

How do I fix CVE-2020-23583?

No fix has been published for CVE-2020-23583 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2020-23583 being exploited?

There is no known exploitation of CVE-2020-23583 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Sources

Also known as GHSA-xvqh-5m2j-7624.