CVE-2020-16152 in the critical feed json
The NetConfig UI administrative interface in Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine through 10.0r8a allows attacker…
published 2021-11-14 4 y ago modified 2026-06-17 4 mo ago also EUVD-2020-8118
- cvss
- 9.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 35.5%
- EPSS 35.5% chance of exploitation in 30 days, percentile 98%
- public exploits
- 1
- Metasploit
Summary
The NetConfig UI administrative interface in Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine through 10.0r8a allows attackers to execute PHP code as the root user via remote HTTP requests that insert this code into a log file and then traverse to that file.
Patch / fix
- extremenetworks aerohive_netconfig 10.0r8a
Timeline
- First public exploit (Metasploit exploit/unix/webapp/aerohive_netconfig_lfi_log_poison_rce)
- Published
Exploit prediction
35.52% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/unix/webapp/aerohive_netconfig_lfi_log_poison_rce Aerohive NetConfig 10.0r8a LFI and log poisoning to RCE metasploit exploit, excellent rank, 2020-02-17
- packetstormsecurity.com http://packetstormsecurity.com/files/164957/Aerohive-NetConfig-10.0r8a-Local-File-Inclusion-Remote-Code-Execution.html referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-829 Inclusion of Functionality from Untrusted Control Sphere
References
-
packetstormsecurity.com
/files/164957/Aerohive-NetConfig-10.0r8a-Local-File-Inclusion-Remote-Code-Execution.html
exploit, third-party-advisory, vdb-entry
-
gtacknowledge.extremenetworks.com
/articles/Vulnerability_Notice/VN-2020-001
vendor-advisory
Sources
- CVE List CVE-2020-16152
- NVD CVE-2020-16152
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.