CVE-2020-17456

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

SEOWON INTECH SLC-130 And SLR-120S devices allow Remote Code Execution via the ipAddr parameter to the system_log.cgi page.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/158933/Seowon-SlC-130-Router-Remote-Code-Execution.htmlThird Party Advisory, VDB Entry
http://packetstormsecurity.com/files/166273/Seowon-SLR-120-Router-Remote-Code-Execution.htmlThird Party Advisory, VDB Entry
https://github.com/TAPESH-TEAM/CVE-2020-17456-Seowon-SLR-120S42G-RCE-Exploit-UnauthenticatedExploit, Third Party Advisory
https://maj0rmil4d.github.io/Seowon-SlC-130-And-SLR-120S-Exploit/Exploit, Third Party Advisory
https://www.exploit-db.com/exploits/50821Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/158933/Seowon-SlC-130-Router-Remote-Code-Execution.htmlThird Party Advisory, VDB Entry
http://packetstormsecurity.com/files/166273/Seowon-SLR-120-Router-Remote-Code-Execution.htmlThird Party Advisory, VDB Entry
https://github.com/TAPESH-TEAM/CVE-2020-17456-Seowon-SLR-120S42G-RCE-Exploit-UnauthenticatedExploit, Third Party Advisory
https://maj0rmil4d.github.io/Seowon-SlC-130-And-SLR-120S-Exploit/Exploit, Third Party Advisory
https://www.exploit-db.com/exploits/50821Third Party Advisory, VDB Entry

Timeline

Published: Aug 20, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-174575.4Fujitsu ServerView Suite iRMC before 9.62F allows XSS. An authenticated attacker can store an XSS payload in the PSCU_FILE_INIT field of a S CVE-2020-174585.4A post-authenticated stored XSS was found in MultiUx v.3.1.12.0 via the /multiux/SaveMailbox LastName field.CVE-2020-17465.0A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 CVE-2020-174627.8CMS Made Simple 2.2.14 allows Authenticated Arbitrary File Upload because the File Manager does not block .ptar files, a related issue to CV CVE-2020-174639.8FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.CVE-2020-174656.1Dashboards and progressiveProfileForms in ForgeRock Identity Manager before 7.0.0 are vulnerable to stored XSS. The vulnerability affects ve CVE-2020-174669.8Turcom TRCwifiZone through 2020-08-10 allows authentication bypass by visiting manage/control.php and ignoring 302 Redirect responses.CVE-2020-174679.1An issue was discovered in FNET through 4.6.4. The code for processing the hostname from an LLMNR request doesn't check for '\0' termination CVE-2020-174687.5An issue was discovered in FNET through 4.6.4. The code for processing the hop-by-hop header (in the IPv6 extension headers) doesn't check f CVE-2020-174697.5An issue was discovered in FNET through 4.6.4. The code for IPv6 fragment reassembly tries to access a previous fragment starting from a net CVE-2020-17479.8A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it p CVE-2020-174705.3An issue was discovered in FNET through 4.6.4. The code that initializes the DNS client interface structure does not set sufficiently random