Read the docs
TI-2020-07056 Aliases CVE-2020-8797GHSA-c86c-pc2p-fq87

Juplink RX4-1500 v1.0.3 allows remote attackers to gain root access to the Linux…

Priority LOW 31CWE-78Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.

Summary

Juplink RX4-1500 v1.0.3 allows remote attackers to gain root access to the Linux subsystem via an unsanitized exec call (aka Command Line Injection), if the undocumented telnetd service is enabled and the attacker can authenticate as admin from the local network.

Why it matters now

EPSS 0.00934 60th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:juplink:rx4-1500_firmware:1.0.3:*:*:*:*:*:*:*1.0.3VulnerableJuplink
cpe:2.3:h:juplink:rx4-1500:-:*:*:*:*:*:*:*not specified by NVDRunning onJuplink
  • cpe:2.3:o:juplink:rx4-1500_firmware:1.0.3:*:*:*:*:*:*:* Versions 1.0.3 Vulnerable ·Juplink
  • cpe:2.3:h:juplink:rx4-1500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juplink

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-8797
  2. 2026-10-03 Alias added: GHSA-c86c-pc2p-fq87

References

Exploit 1

  • TI-2023-21656 Juplink RX4-1500 Command Injection Vulnerability CVSS 3.1HIGH 8.8
  • TI-2023-21658 Juplink RX4-1500 homemng.htm Command Injection Vulnerability CVSS 3.1HIGH 8.8
  • TI-2023-21657 Juplink RX4-1500 Hard-coded Credential Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2023-21655 Juplink RX4-1500 Stack-based Buffer Overflow Vulnerability CVSS 3.1CRITICAL 9.0
  • TI-2023-21654 Juplink RX4-1500 Credential Disclosure Vulnerability CVSS 3.1HIGH 8.8
  • TI-2020-07057 httpd in Juplink RX4-1500 v1.0.3-v1.0.5 allows remote attackers to change or access… CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences