CVE-2020-5179
Last modified
CVE-2020-5179 is a high-severity vulnerability rated 7.2/10 on the CVSS scale. Comtech Stampede FX-1010 7.4.3 devices allow remote authenticated administrators to execute arbitrary OS commands by navigating to the Diagnostics Ping page and entering shell metacharacters in the Target IP address field. (In some cases, authentication can be achieved with the comtech password for the comtech account.). EPSS estimates a 2.84% chance of exploitation in the next 30 days.
Description
Comtech Stampede FX-1010 7.4.3 devices allow remote authenticated administrators to execute arbitrary OS commands by navigating to the Diagnostics Ping page and entering shell metacharacters in the Target IP address field. (In some cases, authentication can be achieved with the comtech password for the comtech account.)
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Comtech | Stampede Fx-1010 Firmware | 7.4.3 |
References
- https://overload.cl/blog/comtech-authenticated-rce-on-comtech-fx-series/Exploit, Third Party Advisory
- https://sku11army.blogspot.com/2020/01/comtech-authenticated-rce-on-comtech-fx.htmlExploit, Third Party Advisory
- https://overload.cl/blog/comtech-authenticated-rce-on-comtech-fx-series/Exploit, Third Party Advisory
- https://sku11army.blogspot.com/2020/01/comtech-authenticated-rce-on-comtech-fx.htmlExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-5179?
How severe is CVE-2020-5179?
How do I fix CVE-2020-5179?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-5143SonicOS SSLVPN login page allows a remote unauthenticated at…5.3
- CVE-2020-5144SonicWall Global VPN client version 4.10.4.0314 and earlier …7.8
- CVE-2020-5145SonicWall Global VPN client version 4.10.4.0314 and earlier …8.6
- CVE-2020-5146A vulnerability in SonicWall SMA100 appliance allow an authe…7.2
- CVE-2020-5147SonicWall NetExtender Windows client vulnerable to unquoted …5.3
- CVE-2020-5148SonicWall SSO-agent default configuration uses NetAPI to pro…8.2
- CVE-2020-5180Viscosity 1.8.2 on Windows and macOS allows an unprivileged …7.8
- CVE-2020-5182The J-BusinessDirectory extension before 5.2.9 for Joomla! a…6.5
- CVE-2020-5183FTPGetter Professional 5.97.0.223 is vulnerable to a memory …7.5
- CVE-2020-5186DNN (formerly DotNetNuke) through 9.4.4 allows XSS (issue 1 …5.4
- CVE-2020-5187DNN (formerly DotNetNuke) through 9.4.4 allows Path Traversa…8.8
- CVE-2020-5188DNN (formerly DotNetNuke) through 9.4.4 has Insecure Permiss…6.5
Are you affected by CVE-2020-5179?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST