CVE-2020-11733

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

An issue was discovered on Spirent TestCenter and Avalanche appliance admin interface firmware. An attacker, who already has access to an SSH restricted shell, can achieve root access via shell metacharacters. The attacker can then, for example, read sensitive files such as appliance admin configuration source code. This affects Spirent TestCenter and Avalanche products which chassis version <= 5.08. The SSH restricted shell is available with default credentials.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gist.github.com/a05110511t/65d07bc776d7c11b4ccf112a09cca4abThird Party Advisory
https://github.com/a05110511t/CVE/blob/master/CVE-2020-11733.mdThird Party Advisory
https://gist.github.com/a05110511t/65d07bc776d7c11b4ccf112a09cca4abThird Party Advisory
https://github.com/a05110511t/CVE/blob/master/CVE-2020-11733.mdThird Party Advisory

Timeline

Published: Aug 13, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-117346.1cgi-bin/go in CyberSolutions CyberMail 5 or later allows XSS via the ACTION parameter.CVE-2020-117355.3The private-key operations in ecc.c in wolfSSL before 4.4.0 do not use a constant-time modular inverse when mapping to affine coordinates, a CVE-2020-117363.9fr-archive-libarchive.c in GNOME file-roller through 3.36.1 allows Directory Traversal during extraction because it lacks a check of whether CVE-2020-117376.1A cross-site scripting (XSS) vulnerability in Web Client in Zimbra 9.0 allows a remote attacker to craft links in an E-Mail message or calen CVE-2020-117387.5The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the f CVE-2020-117397.8An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service or possibly gain privileges because of m CVE-2020-11747.8A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who succ CVE-2020-117405.5An issue was discovered in xenoprof in Xen through 4.13.x, allowing guest OS users (without active profiling) to obtain sensitive informatio CVE-2020-117418.8An issue was discovered in xenoprof in Xen through 4.13.x, allowing guest OS users (with active profiling) to obtain sensitive information a CVE-2020-117425.5An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service because of bad continuation handling in CVE-2020-117435.5An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service because of a bad error path in GNTTABOP_CVE-2020-117499.0Pandora FMS 7.0 NG <= 746 suffers from Multiple XSS vulnerabilities in different browser views. A network administrator scanning a SNMP devi