CVE-2020-7594

Name of the Vulnerable Software and Affected Versions MultiTech Conduit MTCDT-LVW2-24XX version 1.4.17-ocea-13592

Description The issue allows remote authenticated administrators to execute arbitrary OS commands. This can be achieved by navigating to the Debug Options page and entering shell metacharacters in the interface JSON field of the ping function.

Recommendations For version 1.4.17-ocea-13592, as a temporary workaround, consider restricting access to the Debug Options page and the ping function until a patch is available. Avoid using the interface JSON field in the ping function to minimize the risk of exploitation.