What’s Vulnerable › Vulnerabilities

CVE-2020-10871

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-03-23 · updated 2026-06-17
• Weakness: CWE-200

Description

In OpenWrt LuCI git-20.x, remote unauthenticated attackers can retrieve the list of installed packages and services. NOTE: the vendor disputes the significance of this report because, for instances reachable by an unauthenticated actor, the same information is available in other (more complex) ways, and there is no plan to restrict the information further

Affected products

• openwrt luci: git-20.049.11521-bebfe20, git-20.078.22902-0ed0d42

References

• https://github.com/openwrt/luci/issues/3563#issuecomment-578522860
• https://github.com/openwrt/luci/issues/3653#issue-567892007
• https://github.com/openwrt/luci/issues/3766
• https://github.com/openwrt/luci/issues/3563#issuecomment-578522860
• https://github.com/openwrt/luci/issues/3653#issue-567892007
• https://github.com/openwrt/luci/issues/3766

Get alerted when CVE-2020-10871 or the next vulnerability affects your stack