Read the docs
TI-2020-07057 Aliases CVE-2020-8798GHSA-ccf5-cxqv-x84v

httpd in Juplink RX4-1500 v1.0.3-v1.0.5 allows remote attackers to change or access…

Priority LOW 25CWE-276Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

httpd in Juplink RX4-1500 v1.0.3-v1.0.5 allows remote attackers to change or access router settings by connecting to the unauthenticated setup3.htm endpoint from the local network.

Why it matters now

EPSS 0.00398 34th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:juplink:rx4-1500_firmware:*:*:*:*:*:*:*:*1.0.3 – 1.0.5VulnerableJuplink
cpe:2.3:h:juplink:rx4-1500:-:*:*:*:*:*:*:*not specified by NVDRunning onJuplink
  • cpe:2.3:o:juplink:rx4-1500_firmware:*:*:*:*:*:*:*:* Versions 1.0.3 – 1.0.5 Vulnerable ·Juplink
  • cpe:2.3:h:juplink:rx4-1500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juplink

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-8798
  2. 2026-10-03 Alias added: GHSA-ccf5-cxqv-x84v

References

Exploit 1

  • TI-2023-21656 Juplink RX4-1500 Command Injection Vulnerability CVSS 3.1HIGH 8.8
  • TI-2023-21658 Juplink RX4-1500 homemng.htm Command Injection Vulnerability CVSS 3.1HIGH 8.8
  • TI-2023-21657 Juplink RX4-1500 Hard-coded Credential Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2023-21655 Juplink RX4-1500 Stack-based Buffer Overflow Vulnerability CVSS 3.1CRITICAL 9.0
  • TI-2023-21654 Juplink RX4-1500 Credential Disclosure Vulnerability CVSS 3.1HIGH 8.8
  • TI-2020-07056 Juplink RX4-1500 v1.0.3 allows remote attackers to gain root access to the Linux… CVSS 3.1MEDIUM 6.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences