CVE-2020-8171

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2020-8171
We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AirOS v6.2.0 and prior TI, XW and XM boards, according to the description below:There are certain end-points containing functionalities that are vulnerable to command injection. It is possible to craft an input string that passes the filter check but still contains commands, resulting in remote code execution.Mitigation:Update to the latest AirMax AirOS firmware version available at the AirMax download page.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://community.ui.com/releases/Security-advisory-bulletin-011-011/d0d411a5-6dcb-4988-9709-d57f50957261 Vendor Advisory
https://community.ui.com/releases/airMAX-M-v6-3-0/c8d5dec9-4030-4d7e-b23f-6a5b35ed3d83 Vendor Advisory
https://www.ui.com/download/airmax-m Release Notes
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:ui:airos:*:*:*:*:*:*:*:*
OR cpe:2.3:h:ui:ag-hp-2g16:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:ag-hp-2g20:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:ag-hp-5g23:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:ag-hp-5g27:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:airgrid_m:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:airgrid_m2:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:airgrid_m5:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:ar:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:ar-hp:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:bm2-ti:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:bm2hp:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:bm5-ti:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:bm5hp:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:is-m5:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:lbem5-23:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:litestation_m5:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:locom2:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:locom5:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:locom9:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:m2:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:m3:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:m365:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:m5:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:m900:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:nb-2g18:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:nb-5g22:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:nb-5g25:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:nbe-m2-13:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:nbe-m5-16:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:nbe-m5-19:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:nbm3:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:nbm365:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:nbm9:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:nsm2:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:nsm3:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:nsm365:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:nsm5:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:pbe-m2-400:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:pbe-m5-300:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:pbe-m5-300-iso:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:pbe-m5-400:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:pbe-m5-400-iso:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:pbe-m5-620:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:pbm10:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:pbm365:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:pbm5:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:picom2hp:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:power_ap_n:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:rm2-ti:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:rm5-ti:-:*:*:*:*:*:*:*
History

No history.

Information

Published : 2020-05-26 16:15

Updated : 2023-12-10 13:27

NVD link : CVE-2020-8171

Mitre link : CVE-2020-8171

CVE.ORG link : CVE-2020-8171

JSON object : View

Products Affected

ui

  • is-m5
  • power_ap_n
  • nbm3
  • pbe-m5-400
  • nbe-m5-16
  • airos
  • nbe-m2-13
  • nsm5
  • pbe-m5-620
  • m5
  • m365
  • locom9
  • pbe-m5-300-iso
  • rm2-ti
  • pbe-m5-300
  • airgrid_m2
  • bm2hp
  • ag-hp-5g27
  • locom2
  • nsm365
  • picom2hp
  • nbe-m5-19
  • m2
  • lbem5-23
  • pbe-m5-400-iso
  • rm5-ti
  • ag-hp-5g23
  • ar
  • pbm365
  • m900
  • ag-hp-2g16
  • airgrid_m
  • nb-5g22
  • nbm9
  • nsm3
  • airgrid_m5
  • pbe-m2-400
  • ar-hp
  • ag-hp-2g20
  • nbm365
  • litestation_m5
  • m3
  • bm5-ti
  • bm2-ti
  • nb-2g18
  • pbm10
  • locom5
  • bm5hp
  • nsm2
  • pbm5
  • nb-5g25
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')