Evenroute Iqrouter
6 CVEs affecting Evenroute Iqrouter. Latest disclosed: 2020-04-21. Critical: 4, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-11967 | Critical | 9.8 | 2020-04-21 | In IQrouter through 3.3.1, remote attackers can control the device (restart network, reboot, upgrade, reset) because of Incorrect Access Control. Note: The ven… |
CVE-2020-11966 | Critical | 9.8 | 2020-04-21 | In IQrouter through 3.3.1, the Lua function reset_password in the web-panel allows remote attackers to change the root password arbitrarily. Note: The vendor c… |
CVE-2020-11965 | Critical | 9.8 | 2020-04-21 | In IQrouter through 3.3.1, there is a root user without a password, which allows attackers to gain full remote access via SSH. Note: The vendor claims that thi… |
CVE-2020-11963 | Critical | 9.8 | 2020-04-21 | IQrouter through 3.3.1, when unconfigured, has multiple remote code execution vulnerabilities in the web-panel because of Bash Shell Metacharacter Injection. N… |
CVE-2020-11968 | High | 7.5 | 2020-04-21 | In the web-panel in IQrouter through 3.3.1, remote attackers can read system logs because of Incorrect Access Control. Note: The vendor claims that this vulner… |
CVE-2020-11964 | High | 7.5 | 2020-04-21 | In IQrouter through 3.3.1, the Lua function diag_set_password in the web-panel allows remote attackers to change the root password arbitrarily. Note: The vendo… |