CVEvulnerability
CVE-2020-16152
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2021-11-14
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-829
Description
The NetConfig UI administrative interface in Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine through 10.0r8a allows attackers to execute PHP code as the root user via remote HTTP requests that insert this code into a log file and then traverse to that file.
Affected configurations
• extremenetworks aerohive netconfig (< 10.0r8a)
• extremenetworks aerohive netconfig 10.0r8a
Related
Weakness · CWE (1)
- CWE-829 Inclusion of Functionality from Untrusted Control Sphere weakness
References
- http://packetstormsecurity.com/files/164957/Aerohive-NetConfig-10.0r8a-Local-File-Inclusion-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry
- https://gtacknowledge.extremenetworks.com/articles/Vulnerability_Notice/VN-2020-001 Vendor Advisory
- http://packetstormsecurity.com/files/164957/Aerohive-NetConfig-10.0r8a-Local-File-Inclusion-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry
- https://gtacknowledge.extremenetworks.com/articles/Vulnerability_Notice/VN-2020-001 Vendor Advisory