CVE-2019-14920: Critical severity billion sg600 r2 firmware vulnerability

Published Jan 9, 2020

Updated

Billion Smart Energy Router SG600R2 Firmware v3.02.rc6 allows an authenticated attacker to gain root execution privileges over the device via a hidden etcro/web/adm/systemcommand.asp shell feature.

Affected Software

2 affected components

Billion Sg600 R2 Firmware=3.02-rc6

Billion Sg600 R2

Event History

Jan 9, 2020

CVE Published

via MITRE·04:24 PM

Data Sourced

via MITRE·04:24 PM

Description

Frequently Asked Questions

What is CVE-2019-14920?

CVE-2019-14920 is a vulnerability in Billion Smart Energy Router SG600R2 Firmware v3.02.rc6 that allows an authenticated attacker to gain root execution privileges over the device via a hidden etc_ro/web/adm/system_command.asp shell feature.

How severe is CVE-2019-14920?

CVE-2019-14920 has a severity rating of 8.8, which is considered critical.

Which software is affected by CVE-2019-14920?

Billion Smart Energy Router SG600R2 Firmware v3.02.rc6 is affected by CVE-2019-14920.

How can an attacker exploit CVE-2019-14920?

An authenticated attacker can exploit CVE-2019-14920 by using the hidden system_command.asp shell feature to gain root execution privileges over the device.

Is Billion Smart Energy Router SG600R2 vulnerable?

Yes, Billion Smart Energy Router SG600R2 with Firmware v3.02.rc6 is vulnerable to CVE-2019-14920.