CVE-2020-7982

An issue was discovered in OpenWrt 18.06.0 to 18.06.6 and 19.07.0, and LEDE 17.01.0 to 17.01.7. A bug in the fork of the opkg package manager before 2020-01-25 prevents correct parsing of embedded checksums in the signed repository index, allowing a man-in-the-middle attacker to inject arbitrary package payloads (which are installed without verification).

• CWE-345
• CWE-754

• https://arstechnica.com/information-technology/2020/03/openwrt-is-vulnerable-to-attacks-that-execute-malicious-code/Exploit, Press/Media Coverage, Third Party Advisory
• https://blog.forallsecure.com/uncovering-openwrt-remote-code-execution-cve-2020-7982Exploit, Third Party Advisory
• https://github.com/openwrt/openwrt/commits/masterPatch, Third Party Advisory
• https://openwrt.org/advisory/2020-01-31-1Vendor Advisory
• https://arstechnica.com/information-technology/2020/03/openwrt-is-vulnerable-to-attacks-that-execute-malicious-code/Exploit, Press/Media Coverage, Third Party Advisory
• https://blog.forallsecure.com/uncovering-openwrt-remote-code-execution-cve-2020-7982Exploit, Third Party Advisory
• https://github.com/openwrt/openwrt/commits/masterPatch, Third Party Advisory
• https://openwrt.org/advisory/2020-01-31-1Vendor Advisory

Published

Mar 16, 2020

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-7976GitLab EE 12.4 and later through 12.7.2 has Incorrect Access…5.3
• CVE-2020-7977GitLab EE 8.8 and later through 12.7.2 has Insecure Permissi…5.3
• CVE-2020-7978GitLab EE 12.6 and later through 12.7.2 allows Denial of Ser…7.5
• CVE-2020-7979GitLab EE 8.9 and later through 12.7.2 has Insecure Permissi…5.3
• CVE-2020-7980Intellian Aptus Web 1.24 allows remote attackers to execute …9.8
• CVE-2020-7981sql.rb in Geocoder before 1.6.1 allows Boolean-based SQL inj…9.8
• CVE-2020-7983A CSRF issue in login.asp on Ruckus R500 3.4.2.0.384 devices…8.1
• CVE-2020-7984SolarWinds N-central before 12.1 SP1 HF5 and 12.2 before SP1…7.5
• CVE-2020-7988An issue was discovered in tools/pass-change/result.php in p…8.8
• CVE-2020-7989Adive Framework 2.0.8 has admin/user/add userUsername XSS.6.1
• CVE-2020-7990Adive Framework 2.0.8 has admin/user/add userName XSS.6.1
• CVE-2020-7991Adive Framework 2.0.8 has admin/config CSRF to change the Ad…8.8