CVE-2020-29379

Published: Nov 29, 2020Modified: Nov 21, 2024

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

An issue was discovered on V-SOL V1600D4L V1.01.49 and V1600D-MINI V1.01.48 OLT devices. During the process of updating the firmware, the update script starts a telnetd -l /bin/sh process that does not require authentication for TELNET access.

Affected (2)

Products: Vsolcn: V1600d4l Firmware, V1600d Mini Firmware

Vsolcn

2 products

V1600d4l Firmware

V1600d Mini Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Vsolcn V1600d4l Firmware	Version 1.01.49

Running on/with	Platform Versions
Vsolcn V1600d4l	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Vsolcn V1600d Mini Firmware	Version 1.01.48

Running on/with	Platform Versions
Vsolcn V1600d Mini	All versions

Related CWEs

CWE-306

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (2)

https://seclists.org/fulldisclosure/2020/Jul/14

Source: cve@mitre.org

ExploitMailing ListThird Party Advisory

https://seclists.org/fulldisclosure/2020/Jul/14

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitMailing ListThird Party Advisory

Timeline

No history available yet.