CVE-2020-24849

A remote code execution vulnerability is identified in FruityWifi through 2.4. Due to improperly escaped shell metacharacters obtained from the POST request at the page_config_adv.php page, it is possible to perform remote code execution by an authenticated attacker. This is similar to CVE-2018-17317.

• CWE-78

• http://fruitywifi.com/index_eng.htmlVendor Advisory
• https://gist.github.com/harsh-bothra/f899045b16bbba264628d79d52c07c22Exploit, Third Party Advisory
• https://github.com/xtr4nge/FruityWifiThird Party Advisory
• http://fruitywifi.com/index_eng.htmlVendor Advisory
• https://gist.github.com/harsh-bothra/f899045b16bbba264628d79d52c07c22Exploit, Third Party Advisory
• https://github.com/xtr4nge/FruityWifiThird Party Advisory

Published

Nov 5, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-24837An integer underflow has been found in the latest version of…7.5
• CVE-2020-24838An integer overflow has been found in the the latest version…7.5
• CVE-2020-24841PNPSCADA 2.200816204020 allows SQL injection via parameter '…9.8
• CVE-2020-24842PNPSCADA 2.200816204020 allows cross-site scripting (XSS), w…6.1
• CVE-2020-24847A Cross-Site Request Forgery (CSRF) vulnerability is identif…4.3
• CVE-2020-24848FruityWifi through 2.4 has an unsafe Sudo configuration [(AL…7.8
• CVE-2020-24855Directory Traversal vulnerability in easywebpack-cli before …5.3
• CVE-2020-24857Cross Site Scripting vulnerabilty found in IXPManager v.5.6.…6.1
• CVE-2020-24860CMS Made Simple 2.2.14 allows an authenticated user with acc…5.4
• CVE-2020-24861GetSimple CMS 3.3.16 allows in parameter 'permalink' on the …5.4
• CVE-2020-24862The catID parameter in Pharmacy Medical Store and Sale Point…7.5
• CVE-2020-24863A memory corruption vulnerability was found in the kernel fu…5.5