What’s Vulnerable › Vulnerabilities

CVE-2020-24376

• Severity: critical (CVSS 9.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-09-16 · updated 2026-06-17
• Weakness: CWE-20

Description

A DNS rebinding vulnerability in the UPnP IGD implementations in Freebox v5 before 1.5.29 and Freebox Server before 4.2.3.

Affected products

• Freebox Delta Firmware: before 4.2.3 — fixed in 4.2.3
• Freebox Mini Firmware: before 4.2.3 — fixed in 4.2.3
• Freebox One Firmware: before 4.2.3 — fixed in 4.2.3
• Freebox Pop Firmware: before 4.2.3 — fixed in 4.2.3
• Freebox Revolution Firmware: before 4.2.3 — fixed in 4.2.3

How to fix

Upgrade to a fixed version: Freebox Delta Firmware 4.2.3; Freebox Mini Firmware 4.2.3; Freebox One Firmware 4.2.3; Freebox Pop Firmware 4.2.3; Freebox Revolution Firmware 4.2.3. Check the vendor advisory for mitigations.

References

• https://dev.freebox.fr/blog/?p=10222
• https://www.gabriel.urdhr.fr/2020/09/23/dns-rebinding-freebox/
• https://dev.freebox.fr/blog/?p=10222
• https://www.gabriel.urdhr.fr/2020/09/23/dns-rebinding-freebox/

Get alerted when CVE-2020-24376 or the next vulnerability affects your stack