CVE-2020-12773

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A security misconfiguration vulnerability exists in the SDK of some Realtek ADSL/PON Modem SoC firmware, which allows attackers using a default password to execute arbitrary commands remotely via the build-in network monitoring tool.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Realtek	ADSL/PON Modem SoC	—

References

https://www.twcert.org.tw/tw/cp-132-3681-2a3f6-1.htmlThird Party Advisory
https://www.twcert.org.tw/tw/cp-132-3681-2a3f6-1.htmlThird Party Advisory

Timeline

Published: Jun 8, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-127746.7D-Link DSL-7740C does not properly validate user input, which allows an authenticated LAN user to inject arbitrary command.CVE-2020-127759.8Hicos citizen certificate client-side component does not filter special characters for command parameters in specific web URLs. An unauthent CVE-2020-127767.2Openfind Mail2000 contains Broken Access Control vulnerability, which can be used to execute unauthorized commands after attackers obtain th CVE-2020-127777.5A function in Combodo iTop contains a vulnerability of Broken Access Control, which allows unauthorized attacker to inject command and discl CVE-2020-127786.1Combodo iTop does not validate inputted parameters, attackers can inject malicious commands and launch XSS attack.CVE-2020-127795.4Combodo iTop contains a stored Cross-site Scripting vulnerability, which can be attacked by uploading file with malicious script.CVE-2020-12787.8An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly handles file operations, aka 'CVE-2020-127807.5A security misconfiguration exists in Combodo iTop, which can expose sensitive information.CVE-2020-127818.8Combodo iTop contains a cross-site request forgery (CSRF) vulnerability, attackers can execute specific commands via malicious site request CVE-2020-127829.8Openfind MailGates contains a Command Injection flaw, when receiving email with specific strings, malicious code in the mail attachment will CVE-2020-127837.5Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and CVE-2020-127845.3cPanel before 86.0.14 allows remote attackers to trigger a bandwidth suspension via mail log strings (SEC-505).