CVE-2020-24572: OS Command Injection

Published Aug 24, 2020

Updated

An issue was discovered in includes/webconsole.php in RaspAP 2.5. With authenticated access, an attacker can use a misconfigured (and virtually unrestricted) web console to attack the underlying OS (Raspberry Pi) running this software, and execute commands on the system (including ones for uploading of files and execution of code).

Affected Software

1 affected component

RaspAP RaspAP=2.5

Remediation

Patch Available

https://github.com/billz/raspap-webgui/commit/dd5ab7bdc213381ee552001dd80c41ca47afab00

Event History

Aug 24, 2020

CVE Published

via MITRE·07:14 PM

Data Sourced

via MITRE·07:14 PM

Description

Frequently Asked Questions

What is the severity of CVE-2020-24572?

The severity of CVE-2020-24572 is critical with a severity value of 8.8.

How does CVE-2020-24572 affect RaspAP?

CVE-2020-24572 affects RaspAP 2.5.

What is the impact of CVE-2020-24572?

CVE-2020-24572 allows an attacker with authenticated access to execute commands on the underlying OS (Raspberry Pi) running RaspAP.

How can I fix CVE-2020-24572?

To fix CVE-2020-24572, it is recommended to update RaspAP to the latest version available.

Where can I find more information about CVE-2020-24572?

More information about CVE-2020-24572 can be found at the following references: [ref1](https://deadb0x.io/lunchb0x/cve-2020-24572/), [ref2](https://github.com/billz/raspap-webgui/commit/dd5ab7bdc213381ee552001dd80c41ca47afab00), [ref3](https://github.com/billz/raspap-webgui/releases).