CVE-2020-12246

Name of the Vulnerable Software and Affected Versions Beeline Smart Box version 2.0.38

Description The issue allows OS command injection via the "Advanced settings > Other > Diagnostics" feature. Specifically, it affects the ping ipaddr parameter in the Ping function, the nslookup ipaddr parameter in the Nslookup function, or the traceroute ipaddr parameter in the Traceroute function.

Recommendations For Beeline Smart Box version 2.0.38, as a temporary workaround, consider restricting access to the "Advanced settings > Other > Diagnostics" feature until a patch is available. Avoid using the ping ipaddr, nslookup ipaddr, and traceroute ipaddr parameters in the affected functions to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.