CVE-2020-21883
HighCVSS 8.8Exploitation Probability (EPSS)
Very high risk92th percentile - higher than 92% of all known CVEs
Summary
UniBox U-50 2.4, UniBox Enterprise Series 2.4, and UniBox Campus Series 2.4 contain an OS command injection vulnerability in the /tools/ping script. This flaw allows an attacker to gain complete control over the device.
Risk Assessment
The risk for the organization includes full device takeover by an attacker, potentially leading to compromise of data confidentiality, integrity, and availability, as well as network security.
Recommendation
It is recommended to immediately update the firmware to the latest version and restrict access to the management interface to trusted IP addresses only.
Original NVD description (English source)
Unibox U-50 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain a OS command injection vulnerability in /tools/ping, which can leads to complete device takeover.