CVE-2020-29381 Command injection in n/a

Critical 9.8 Published 29 Nov 2020 Updated 4 Aug 2024

Attackers can execute arbitrary commands on V-SOL OLT devices via crafted filenames in CLI upload commands.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-29381?

CVE-2020-29381 is a critical command injection vulnerability in n/a, published on 29 Nov 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered on V-SOL V1600D V2.03.69 and V2.03.57, V1600D4L V1.01.49, V1600D-MINI V1.01.48, V1600G1 V2.0.7 and V1.9.7, and V1600G2 V1.1.4 OLT devices. Command injection can occur in "upload tftp syslog" and "upload tftp configuration" in the CLI via a crafted filename.

Weakness: CWE-78

Which versions are affected by CVE-2020-29381?

It affects 5 products.

Products include Vsolcn V1600d-Mini Firmware, Vsolcn V1600d4l Firmware, Vsolcn V1600d Firmware, Vsolcn V1600g1 Firmware, Vsolcn V1600g2 Firmware.

How do I fix CVE-2020-29381?

No fix has been published for CVE-2020-29381 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2020-29381 being exploited?

There is no known exploitation of CVE-2020-29381 in the wild and no public exploit code.

Sources

Also known as GHSA-4rg7-j3g7-39cf.