CVE-2020-8946

HIGH

Netis WF2471 v1.2.30142 - Authenticated OS Command Injection via log_3g_type Parameter

Title source: llm

Description

Netis WF2471 v1.2.30142 devices allow an authenticated attacker to execute arbitrary OS commands via shell metacharacters in the /cgi-bin-igd/sys_log_clean.cgi log_3g_type parameter.

References (1)

Core 1

Core References

Exploit, Third Party Advisory x_refsource_misc

https://sku11army.blogspot.com/2020/02/netis-authenticated-rce-on-wf2471.html

Scores

CVSS v3 8.8

EPSS 0.0187

EPSS Percentile 76.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-78

Status published

Products (1)

netis-systems/wf2471_firmware 1.2.30142

Published Feb 12, 2020

Tracked Since Feb 18, 2026