CVE-2020-10173

EPSS 76.8%◆ VulnCheck KEV

Vexday Risk Score

67High priority

SSVC decision (CISA)

Act

Exploitation + impact → act immediately

Exploit maturity

Proof of concept

Public proof of concept exists, but not yet automated.

CVSS —EPSS 76.8%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

05 Mar 2020Published on NVD

Recommendation: Patch as soon as possible — active exploitation confirmed.

Comtrend VR-3033 DE11-416SSG-C01_R02.A2pvI042j1.d26m devices have Multiple Authenticated Command Injection vulnerabilities via the ping and traceroute diagnostic pages, as demonstrated by shell metacharacters in the pingIpAddress parameter to ping.cgi.

Affected products

n/a · n/a

public PoCs found — 1

cve_referencewww.exploit-db.com/exploits/48142unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://www.exploit-db.com/exploits/48142