cbcvebase.
CVE-2020-11963
published 2020-04-21

CVE-2020-11963: IQrouter through 3.3.1, when unconfigured, has multiple remote code execution vulnerabilities in the web-panel because of Bash Shell Metacharacter Injection…

PriorityP181critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
3.15%
86.3th percentile
IQrouter through 3.3.1, when unconfigured, has multiple remote code execution vulnerabilities in the web-panel because of Bash Shell Metacharacter Injection. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration (which has a required step for setting a secure password on the system), makes this CVE invalid. This vulnerability is “true for any unconfigured release of OpenWRT, and true of many other new Linux distros prior to being configured for the first time”

Affected

1 ranges
VendorProductVersion rangeFixed in
evenrouteiqrouter_firmware<= 3.3.1—

Detection & IOCsextracted from sources · hover to see the quote

url/cgi-bin/luci/er/vlanTag?vlan_tag='`{}`'↗
url/cgi-bin/luci/er/verify_wifi?wifi_conflict='`{}`'↗
url/cgi-bin/luci/er/screen9?save_creds=1&s1&s2='`{}`'&p1&p2↗
url/cgi-bin/luci/er/screen9?save_creds=1&s1='`{}`'&s2&p1&p2↗
url/cgi-bin/luci/er/screen9?save_creds=1&s1&s2&p1&p2='`{}`'↗
url/cgi-bin/luci/er/screen9?save_creds=1&s1&s2&p1='`{}`'&p2↗
url/cgi-bin/luci/er/screen4?save_isp='`{}`↗
url/cgi-bin/luci/er/screen2?set_wan_modem_interfaces='`{}`'↗
url/cgi-bin/luci/er/screen2?find_ip_address_conflict='`{}`'↗
url/cgi-bin/luci/er/screen10?set_security_question='`{}`'↗
url/cgi-bin/luci/er/screen10?set_security_answer='`{}`'&set_security_question=1↗
url/cgi-bin/luci/er/screen1?zonename='`{}`'↗
url/cgi-bin/luci/er/register?email=`{}`↗
url/cgi-bin/luci/er/wifi?enable_guestwifi=1&guest_key=2&disable_guestwifi=1&connection_test=1&disassociate_low_ack_update=1&guestwifi_2g_ssid=3&guestwifi_5g_ssid=4&get_network_details=1&switch_reset_wifi_mode=1&save_creds=1&s1=1&s2='`{}`'&p1=1&p2=1↗
url/cgi-bin/luci/er/reboot_link?link='`{}`'↗
url/cgi-bin/luci/er/diag_wifi/1/2/3/4/5/'`{}`'/↗
url/cgi-bin/luci/er/diag_set_static_wan/'`{}`'/2/3/4/↗
url/cgi-bin/luci/er/diag_set_device_name/'`{}`'/↗
url/cgi-bin/luci/er/diag_pppoe_update/'`{}`'/passs/↗
url/cgi-bin/luci/er/diag_pppoe/'`{}`'/passsswd/↗
url/cgi-bin/luci/er/diag_pppoa_update/'`{}`'/paaaasword/↗
url/cgi-bin/luci/er/advanced_link?link='`{}`'↗
url/cgi-bin/luci/er/screen11.1?email=`{}`&register=123&uilog=123&bg=123↗
url/cgi-bin/luci/er/get_syslog↗
url/cgi-bin/luci/er/reset_password/↗
url/cgi-bin/luci/er/diag_set_password/c00lpasswd/↗
url/cgi-bin/luci/er/index?reset_config=1↗
commandbacktick shell metacharacter injection pattern: '`{cmd}`'↗
  • →Detect unauthenticated GET requests to /cgi-bin/luci/er/* endpoints containing backtick characters (`) in query parameters or URL path segments — the primary injection vector for Bash shell metacharacter RCE. ↗
  • →Alert on HTTP GET requests to /cgi-bin/luci/er/reset_password/ or /cgi-bin/luci/er/diag_set_password/ — these endpoints allow unauthenticated root password changes. ↗
  • →Monitor for HTTP GET requests to /cgi-bin/luci/er/get_syslog — attackers use this endpoint to retrieve command output after blind RCE via the /register email parameter. ↗
  • →Detect use of ${IFS} in HTTP query parameters targeting /cgi-bin/luci/er/* — used as a space substitute to bypass simple input filters in shell injection payloads. ↗
  • →Flag unauthenticated GET requests to /cgi-bin/luci/er/index?reset_config=1 — this resets the router to factory defaults, re-exposing all RCE endpoints. ↗
  • ·All RCE endpoints are only exploitable when the IQrouter is in its unconfigured/initial-setup state. Once the mandatory setup wizard (including password configuration) is completed, these endpoints are no longer accessible without authentication. ↗
  • ·The setup-mode RCE endpoints (vlanTag, verify_wifi, screen1–screen10, register) require the router to be actively in setup/wizard mode; the /wifi and diag_* endpoints are exploitable without any setup-mode requirement. ↗
  • ·The verify_wifi RCE endpoint has an additional precondition: the hide_wifi_config parameter must not be set to true. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.