Auth bypass in Mofinetwork Mofi4500-4gxelte
CVE-2020-15835
An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The authentication function contains undocumented code that provides the ability to authenticate as root without knowing the actual root password. An adversary with the private key can remotely authenticate to the management interface as root.
Vulnerability class: Broken Authentication
EPSS: 0.017 (74.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Mofinetwork Mofi4500-4gxelte
- Mofinetwork Mofi4500-4gxelte_firmware — versions 4.1.5-std
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Patch, x_refsource_MISC, Vendor Advisory)
- cve@mitre.org (Technical Description, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2020-15835?
- CVE-2020-15835 is a critical-severity vulnerability in Mofinetwork Mofi4500-4gxelte, classified under Improper Authentication. CVSS score: 9.8/10. Published 2021-02-01.
- How severe is CVE-2020-15835?
- Critical severity. CVSS v3 base score is 9.8 out of 10.