CVE-2020-24987 — Improper Authentication in Ac18 Firmware

CWE-287 — Improper Authentication3 documents3 sources
Severity
9.8CRITICALNVD
EPSS
2.6%
top 14.22%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Tendacn Ac18 Firmware
Timeline
PublishedSep 4
Latest updateMay 24

Description

Tenda AC18 Router through V15.03.05.05_EN and through V15.03.05.19(6318) CN devices could cause a remote code execution due to incorrect authentication handling of vulnerable logincheck() function in /usr/lib/lua/ngx_authserver/ngx_wdas.lua file if the administrator UI Interface is set to "radius".

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages1 packages

▶NVDtendacn/ac18_firmwarev15.03.05.05_en+1

🔴Vulnerability Details

2
GHSA
GHSA-q9jc-x24x-r9x9: Tenda AC18 Router through V15↗2022-05-24
▶
CVEList
CVE-2020-24987: Tenda AC18 Router through V15↗2020-09-04
▶
CVE-2020-24987 — Improper Authentication | cvebase