CVE-2018-20487

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-04-11 · updated 2026-06-17
Weakness: CWE-20

Description

An issue was discovered in the firewall3 component in Inteno IOPSYS 1.0 through 3.16. The attacker must make a JSON-RPC method call to add a firewall rule as an "include" and point the "path" argument to a malicious script or binary. This gets executed as root when the firewall changes are committed.

Affected products

Inteno Iopsys: from 1.0 through 3.16

References

http://public.inteno.se/?p=feed-inteno-openwrt.git%3Ba=commit%3Bh=e6159ca928d7f0c143be213afc6bf810c0329fe2
https://neonsea.uk/blog/2018/12/26/firewall-includes.html
http://public.inteno.se/?p=feed-inteno-openwrt.git%3Ba=commit%3Bh=e6159ca928d7f0c143be213afc6bf810c0329fe2
https://neonsea.uk/blog/2018/12/26/firewall-includes.html

Get alerted when CVE-2018-20487 or the next vulnerability affects your stack