Vulnerability-Lookup

CNVD-2021-29857

Vulnerability from cnvd - Published: 2021-04-21

Title

Askey 光纤路由器未授权RCE漏洞

Description

Askey（亚旭）为国际⽹络通讯设备全球第⼀⼤专业制造⼚商，主要产品有 ADSL、Cable Modem、ADSL Router、Cable Router 等。 Askey 光纤路由器未授权RCE漏洞，未经授权的远程攻击者可利⽤该漏洞在⽬标设备执⾏任意命令。

Severity

高

Patch Name

Askey 光纤路由器未授权RCE漏洞的补丁

Patch Description

Askey（亚旭）为国际⽹络通讯设备全球第⼀⼤专业制造⼚商，主要产品有 ADSL、Cable Modem、ADSL Router、Cable Router 等。 Askey 光纤路由器未授权RCE漏洞，未经授权的远程攻击者可利⽤该漏洞在⽬标设备执⾏任意命令。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

厂商已发布相关漏洞补丁链接，请关注厂商主页及时更新： https://www.askey.com.tw/

Reference

https://cr1pt0.medium.com/cve-2020-28695-8f8d618ac0b

Impacted products

Name
Askey Askey Fiber Router RTF3505VW-N1

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-28695"
    }
  },
  "description": "Askey\uff08\u4e9a\u65ed\uff09\u4e3a\u56fd\u9645\u2f79\u7edc\u901a\u8baf\u8bbe\u5907\u5168\u7403\u7b2c\u2f00\u2f24\u4e13\u4e1a\u5236\u9020\u2f1a\u5546\uff0c\u4e3b\u8981\u4ea7\u54c1\u6709 ADSL\u3001Cable\nModem\u3001ADSL Router\u3001Cable Router \u7b49\u3002\n\nAskey \u5149\u7ea4\u8def\u7531\u5668\u672a\u6388\u6743RCE\u6f0f\u6d1e\uff0c\u672a\u7ecf\u6388\u6743\u7684\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u2f64\u8be5\u6f0f\u6d1e\u5728\u2f6c\u6807\u8bbe\u5907\u6267\u2f8f\u4efb\u610f\u547d\u4ee4\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u76f8\u5173\u6f0f\u6d1e\u8865\u4e01\u94fe\u63a5\uff0c\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u53ca\u65f6\u66f4\u65b0\uff1a\r\nhttps://www.askey.com.tw/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-29857",
  "openTime": "2021-04-21",
  "patchDescription": "Askey\uff08\u4e9a\u65ed\uff09\u4e3a\u56fd\u9645\u2f79\u7edc\u901a\u8baf\u8bbe\u5907\u5168\u7403\u7b2c\u2f00\u2f24\u4e13\u4e1a\u5236\u9020\u2f1a\u5546\uff0c\u4e3b\u8981\u4ea7\u54c1\u6709 ADSL\u3001Cable\r\nModem\u3001ADSL Router\u3001Cable Router \u7b49\u3002\r\n\r\nAskey \u5149\u7ea4\u8def\u7531\u5668\u672a\u6388\u6743RCE\u6f0f\u6d1e\uff0c\u672a\u7ecf\u6388\u6743\u7684\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u2f64\u8be5\u6f0f\u6d1e\u5728\u2f6c\u6807\u8bbe\u5907\u6267\u2f8f\u4efb\u610f\u547d\u4ee4\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Askey \u5149\u7ea4\u8def\u7531\u5668\u672a\u6388\u6743RCE\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Askey Askey Fiber Router RTF3505VW-N1"
  },
  "referenceLink": "https://cr1pt0.medium.com/cve-2020-28695-8f8d618ac0b",
  "serverity": "\u9ad8",
  "submitTime": "2021-04-21",
  "title": "Askey \u5149\u7ea4\u8def\u7531\u5668\u672a\u6388\u6743RCE\u6f0f\u6d1e"
}

CVE-2020-28695 (GCVE-0-2020-28695)

Vulnerability from cvelistv5 – Published: 2021-03-26 17:09 – Updated: 2024-08-04 16:40

Summary

Askey Fiber Router RTF3505VW-N1 BR_SV_g000_R3505VWN1001_s32_7 devices allow Remote Code Execution and retrieval of admin credentials to log into the Dashboard or login via SSH, leading to code execution as root.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

1 reference

URL	Tags
https://cr1pt0.medium.com/cve-2020-28695-8f8d618ac0b	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T16:40:59.785Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://cr1pt0.medium.com/cve-2020-28695-8f8d618ac0b"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Askey Fiber Router RTF3505VW-N1 BR_SV_g000_R3505VWN1001_s32_7 devices allow Remote Code Execution and retrieval of admin credentials to log into the Dashboard or login via SSH, leading to code execution as root."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-03-26T17:09:18.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://cr1pt0.medium.com/cve-2020-28695-8f8d618ac0b"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-28695",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Askey Fiber Router RTF3505VW-N1 BR_SV_g000_R3505VWN1001_s32_7 devices allow Remote Code Execution and retrieval of admin credentials to log into the Dashboard or login via SSH, leading to code execution as root."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://cr1pt0.medium.com/cve-2020-28695-8f8d618ac0b",
              "refsource": "MISC",
              "url": "https://cr1pt0.medium.com/cve-2020-28695-8f8d618ac0b"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-28695",
    "datePublished": "2021-03-26T17:09:18.000Z",
    "dateReserved": "2020-11-16T00:00:00.000Z",
    "dateUpdated": "2024-08-04T16:40:59.785Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.