CVE-2020-9027

CRITICAL

ELTEX NTP-RG-1402G and NTP-2 Firmware - OS Command Injection via Ping TRACE Field

Title source: llm
STIX 2.1

Description

ELTEX NTP-RG-1402G 1v10 3.25.3.32 devices allow OS command injection via the TRACE field of the resource ping.cmd. The NTP-2 device is also affected.

References (1)

Core 1
Core References

Scores

CVSS v3 9.8
EPSS 0.0303
EPSS Percentile 85.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-78
Status published
Products (2)
eltex-co/ntp-2_firmware 3.25.1.1226
eltex-co/ntp-rg-1402g_firmware 3.25.3.32
Published Feb 17, 2020
Tracked Since Feb 18, 2026