Read the docs
TI-2020-06479 Aliases CVE-2020-8009GHSA-4mgp-5jjf-m73q

AVB MOTU devices through 2020-01-22 allow /..

Priority LOW 36CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

AVB MOTU devices through 2020-01-22 allow /.. Directory Traversal, as demonstrated by reading the /etc/passwd file.

Why it matters now

EPSS 0.01653 76th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 21

CPEVersionsRoleVendor
cpe:2.3:o:motu:avb_firmware:*:*:*:*:*:*:*:*up to 2020-01-22VulnerableMotu
cpe:2.3:h:motu:112d:-:*:*:*:*:*:*:*not specified by NVDRunning onMotu
cpe:2.3:h:motu:1248:-:*:*:*:*:*:*:*not specified by NVDRunning onMotu
cpe:2.3:h:motu:16a:-:*:*:*:*:*:*:*not specified by NVDRunning onMotu
cpe:2.3:h:motu:24ai:-:*:*:*:*:*:*:*not specified by NVDRunning onMotu
cpe:2.3:h:motu:24ao:-:*:*:*:*:*:*:*not specified by NVDRunning onMotu
cpe:2.3:h:motu:624:-:*:*:*:*:*:*:*not specified by NVDRunning onMotu
cpe:2.3:h:motu:828es:-:*:*:*:*:*:*:*not specified by NVDRunning onMotu
cpe:2.3:h:motu:828x:-:*:*:*:*:*:*:*not specified by NVDRunning onMotu
cpe:2.3:h:motu:8a:-:*:*:*:*:*:*:*not specified by NVDRunning onMotu
  • cpe:2.3:o:motu:avb_firmware:*:*:*:*:*:*:*:* Versions up to 2020-01-22 Vulnerable ·Motu
  • cpe:2.3:h:motu:112d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Motu
  • cpe:2.3:h:motu:1248:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Motu
  • cpe:2.3:h:motu:16a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Motu
  • cpe:2.3:h:motu:24ai:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Motu
  • cpe:2.3:h:motu:24ao:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Motu
  • cpe:2.3:h:motu:624:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Motu
  • cpe:2.3:h:motu:828es:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Motu
  • cpe:2.3:h:motu:828x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Motu
  • cpe:2.3:h:motu:8a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Motu
Show 11 more CPE
CPEVersionsRoleVendor
cpe:2.3:h:motu:8d:-:*:*:*:*:*:*:*not specified by NVDRunning onMotu
cpe:2.3:h:motu:8m:-:*:*:*:*:*:*:*not specified by NVDRunning onMotu
cpe:2.3:h:motu:8pre-es:-:*:*:*:*:*:*:*not specified by NVDRunning onMotu
cpe:2.3:h:motu:avb:-:*:*:*:*:*:*:*not specified by NVDRunning onMotu
cpe:2.3:h:motu:lp32:-:*:*:*:*:*:*:*not specified by NVDRunning onMotu
cpe:2.3:h:motu:m64:-:*:*:*:*:*:*:*not specified by NVDRunning onMotu
cpe:2.3:h:motu:monitor_8:-:*:*:*:*:*:*:*not specified by NVDRunning onMotu
cpe:2.3:h:motu:moto_avb_switch:-:*:*:*:*:*:*:*not specified by NVDRunning onMotu
cpe:2.3:h:motu:stage-b16:-:*:*:*:*:*:*:*not specified by NVDRunning onMotu
cpe:2.3:h:motu:ultralite-mk4:-:*:*:*:*:*:*:*not specified by NVDRunning onMotu
cpe:2.3:h:motu:ultralite_avb:-:*:*:*:*:*:*:*not specified by NVDRunning onMotu
  • cpe:2.3:h:motu:8d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Motu
  • cpe:2.3:h:motu:8m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Motu
  • cpe:2.3:h:motu:8pre-es:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Motu
  • cpe:2.3:h:motu:avb:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Motu
  • cpe:2.3:h:motu:lp32:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Motu
  • cpe:2.3:h:motu:m64:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Motu
  • cpe:2.3:h:motu:monitor_8:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Motu
  • cpe:2.3:h:motu:moto_avb_switch:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Motu
  • cpe:2.3:h:motu:stage-b16:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Motu
  • cpe:2.3:h:motu:ultralite-mk4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Motu
  • cpe:2.3:h:motu:ultralite_avb:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Motu

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-8009
  2. 2026-10-03 Alias added: GHSA-4mgp-5jjf-m73q

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences