Vendors / Evenroute Records 6 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 4
CVSS high 2
Exploited now Evenroute records in CISA KEV No Evenroute vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 49
In IQrouter through 3.3.1, remote attackers can control the device (restart network, reboot, upgrade, reset) because of Incorrect Access Control.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03269 · Published 2020-04-21 · No fix listed CWE-862
Priority MEDIUM 48
In IQrouter through 3.3.1, the Lua function reset_password in the web-panel allows remote attackers to change the root password arbitrarily.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03068 · Published 2020-04-21 · No fix listed CWE-521
Priority MEDIUM 48
IQrouter through 3.3.1, when unconfigured, has multiple remote code execution vulnerabilities in the web-panel because of Bash Shell Metacharacter Injection.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03225 · Published 2020-04-21 · No fix listed CWE-78
Priority MEDIUM 46
In IQrouter through 3.3.1, there is a root user without a password, which allows attackers to gain full remote access via SSH.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02068 · Published 2020-04-21 · No fix listed CWE-287
Priority LOW 38
In the web-panel in IQrouter through 3.3.1, remote attackers can read system logs because of Incorrect Access Control.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.02658 · Published 2020-04-21 · No fix listed CWE-532
Priority LOW 37
In IQrouter through 3.3.1, the Lua function diag_set_password in the web-panel allows remote attackers to change the root password arbitrarily.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.02304 · Published 2020-04-21 · No fix listed CWE-287
Open these records in search → All records by CVSS severity
4 2 0 0 0
THREATIST.IORead the docs