VulnerabilityModified

CVE-2020-7842

Improper Input validation vulnerability exists in Netis Korea D'live AP which could cause arbitrary command injection and execution when the time setting (using ntpServerlp1 parameter) for the users.

MEDIUM 6.6EPSS 1.55%

Does this matter?

Lower severity and a low EPSS score (1.55%). Track it; it rarely justifies an emergency change on its own.

Description

Improper Input validation vulnerability exists in Netis Korea D'live AP which could cause arbitrary command injection and execution when the time setting (using ntpServerlp1 parameter) for the users. This affects D'live set-top box AP(WF2429TB) v1.1.10.

CVSS 3.1: 6.6 MEDIUMCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS: 1.55% probability · 74th percentile
CISA KEV: Not listed
Weakness: CWE-20
Affected: netu/wf2429tb firmware
Source: vuln@krcert.or.kr

References

https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35797Third Party Advisory
https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35797Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.