CVE-2020-8171 Command injection in AirMax AirOS for TI, XW and XM boards
Attackers can execute arbitrary commands on AirMax AirOS devices via crafted input to vulnerable endpoints, requiring a firmware upgrade.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-8171?
CVE-2020-8171 is a critical command injection vulnerability in AirMax AirOS for TI, XW and XM boards, published on 26 May 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AirOS v6.2.0 and prior TI, XW and XM boards, according to the description below:There are certain end-points containing functionalities that are vulnerable to command injection. It is possible to craft an input string that passes the filter check but still contains commands, resulting in remote code execution.Mitigation:Update to the latest AirMax AirOS firmware version available at the AirMax download page.
Which versions are affected by CVE-2020-8171?
It affects 1 product.
Products include Ui Airos.
How do I fix CVE-2020-8171?
No fix has been published for CVE-2020-8171 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2020-8171 being exploited?
There is no known exploitation of CVE-2020-8171 in the wild and no public exploit code.
Other vulnerabilities in AirMax AirOS for TI, XW and XM boards
Sources
Also known as GHSA-x5pj-xg2p-hp28.