VulnerabilityModified
CVE-2020-22007
OS Command Injection vulnerability in OKER G955V1 v1.03.02.20161128, allows physical attackers to interrupt the boot sequence and execute arbitrary commands with root privileges.
MEDIUM 6.8EPSS 2.25%
Does this matter?
Lower severity and a low EPSS score (2.25%). Track it; it rarely justifies an emergency change on its own.
Description
OS Command Injection vulnerability in OKER G955V1 v1.03.02.20161128, allows physical attackers to interrupt the boot sequence and execute arbitrary commands with root privileges.
- CVSS 3.1
- 6.8 MEDIUMCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 2.25% probability · 82th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-862
- Affected
- okerthai/g955v1 firmware
- Source
- cve@mitre.org
References
- https://gist.github.com/tanprathan/69fbf6fbac11988e12f44069ec5b18ea#file-cve-2020-22007-txtThird Party Advisory
- https://www.dropbox.com/s/cnzwbxhxl0ahzoa/OKER_UART_2.mp4Exploit, Third Party Advisory
- http://www.okerthai.comVendor Advisory
- https://gist.github.com/tanprathan/69fbf6fbac11988e12f44069ec5b18ea#file-cve-2020-22007-txtThird Party Advisory
- https://www.dropbox.com/s/cnzwbxhxl0ahzoa/OKER_UART_2.mp4Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.