CVE-2020-16152: Critical severity extreme networks aerohive netconfig vulnerability
The NetConfig UI administrative interface in Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine through 10.0r8a allows attackers to execute PHP code as the root user via remote HTTP requests that insert this code into a log file and then traverse to that file.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2020-16152.
What is the severity of CVE-2020-16152?
The severity of CVE-2020-16152 is critical.
Which software is affected by CVE-2020-16152?
The software affected by CVE-2020-16152 is Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine up to version 10.0r8a.
How can an attacker exploit CVE-2020-16152?
An attacker can exploit CVE-2020-16152 by executing PHP code as the root user via remote HTTP requests.
Are there any references related to CVE-2020-16152?
Yes, you can find more information about CVE-2020-16152 in the following references: [Packet Storm Security](http://packetstormsecurity.com/files/164957/Aerohive-NetConfig-10.0r8a-Local-File-Inclusion-Remote-Code-Execution.html) and [Extreme Networks GTAC Knowledge Article](https://gtacknowledge.extremenetworks.com/articles/Vulnerability_Notice/VN-2020-001).