cbcvebase.
CVE-2020-12447
published 2020-04-29

CVE-2020-12447: A Local File Inclusion (LFI) issue on Onkyo TX-NR585 1000-0000-000-0008-0000 devices allows remote unauthenticated users on the network to read sensitive files…

PriorityP260high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EXPLOIT
EPSS
11.82%
95.6th percentile
A Local File Inclusion (LFI) issue on Onkyo TX-NR585 1000-0000-000-0008-0000 devices allows remote unauthenticated users on the network to read sensitive files via %2e%2e%2f directory traversal, as demonstrated by reading /etc/shadow.

Affected

1 ranges
VendorProductVersion rangeFixed in
onkyotx-nr585_firmware——

Detection & IOCsextracted from sources · hover to see the quote

url{{BaseURL}}/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd↗
path%2e%2e%2f directory traversal to /etc/shadow↗
  • →Detect directory traversal attempts against Onkyo TX-NR585 web interface by matching URL-encoded traversal sequences (%2e%2e%2f) in HTTP GET requests targeting sensitive files such as /etc/passwd or /etc/shadow. ↗
  • →Successful exploitation returns HTTP 200 with response body matching the regex 'root:[x*]:0:0', indicating /etc/passwd content was returned. ↗
  • →The attack is unauthenticated and requires no prior access; any HTTP GET from the local network using the traversal path should be flagged. ↗
  • ·Vulnerability is specific to Onkyo TX-NR585 firmware version 1000-0000-000-0008-0000 only; detections should be scoped to this firmware version/CPE. ↗

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.