CVE-2020-11963

{
  "id": "CVE-2020-11963",
  "cveTags": [
    {
      "tags": [
        "disputed"
      ],
      "sourceIdentifier": "cve@mitre.org"
    }
  ],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-04-21T13:15:14.770",
  "references": [
    {
      "url": "https://evenroute.com/",
      "tags": [
        "Product"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://evenroute.zendesk.com/hc/en-us/articles/216107838-How-do-I-configure-an-IQrouter-",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://openwrt.org/docs/guide-quick-start/walkthrough_login",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://pastebin.com/grSCSBSu",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://evenroute.com/",
      "tags": [
        "Product"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://evenroute.zendesk.com/hc/en-us/articles/216107838-How-do-I-configure-an-IQrouter-",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://openwrt.org/docs/guide-quick-start/walkthrough_login",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://pastebin.com/grSCSBSu",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "IQrouter through 3.3.1, when unconfigured, has multiple remote code execution vulnerabilities in the web-panel because of Bash Shell Metacharacter Injection. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration (which has a required step for setting a secure password on the system), makes this CVE invalid. This vulnerability is “true for any unconfigured release of OpenWRT, and true of many other new Linux distros prior to being configured for the first time”"
    },
    {
      "lang": "es",
      "value": "** EN DISPUTA ** IQrouter versiones hasta la versión 3.3.1, cuando no está configurado, tiene múltiples vulnerabilidades de ejecución de código remota en el panel web debido a una Inyección de Metacaracteres de Shell Bash. Nota: El proveedor afirma que esta vulnerabilidad sólo puede ocurrir en una red nueva que, después de iniciar la configuración inicial forzada (que tiene un paso requerido para establecer una contraseña segura en el sistema), hace que este CVE no sea válido. Esta vulnerabilidad es \"verdadera para cualquier versión no configurada de OpenWRT, y verdadera para muchas otras nuevas distribuciones de Linux antes de ser configuradas por primera vez\""
    }
  ],
  "lastModified": "2026-06-17T02:51:08.620",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:evenroute:iqrouter_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "386BF9CD-7FB1-4E0A-86D1-4690E9BEC80E",
              "versionEndIncluding": "3.3.1"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:evenroute:iqrouter:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "9B078518-BE47-404B-9365-4D25EEA6AB33"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}