CVE-2020-13712

MGOS Command Injection

State: Published
Severity: 7.8 High
Published: Dec 20, 2024
Updated: Dec 26, 2024
Reserved: Jun 1, 2020

Description

A command injection is possible through the user interface, allowing arbitrary command execution as the root user. oMG2000 running MGOS 3.15.1 or earlier is affected.

MG90 running MGOS 4.2.1 or earlier is affected.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

Affected Products

Product	Versions
MGOSSierra Wireless	all versions before 3.15.1Affected
MGOSSierra Wireless	all versions before 4.2.1Affected

References

https://source.sierrawireless.com/-/media/support_downloads/security-bulletins/pdf/swi-psa-2020-006---mgos-security-update.ashx

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.