CVE-2020-16152
9.8
CRITICAL · CVSS 3.1 · EPSS 35.5% (pctl 98)
Patch early
EPSS 35.5% — above the 10% action threshold.
Description
The NetConfig UI administrative interface in Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine through 10.0r8a allows attackers to execute PHP code as the root user via remote HTTP requests that insert this code into a log file and then traverse to that file.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 35.52% — more likely to be exploited than 98% of all CVEs |
| Weakness | CWE-829 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2021-11-14 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| extremenetworks | aerohive netconfig |
References
- http://packetstormsecurity.com/files/164957/Aerohive-NetConfig-10.0r8a-Local-File-Inclusion-Remote-Code-Execution.html
- https://gtacknowledge.extremenetworks.com/articles/Vulnerability_Notice/VN-2020-001
- http://packetstormsecurity.com/files/164957/Aerohive-NetConfig-10.0r8a-Local-File-Inclusion-Remote-Code-Execution.html
- https://gtacknowledge.extremenetworks.com/articles/Vulnerability_Notice/VN-2020-001
→ the Explorer · watch your stack · NVD