CVE-2020-13859

Name of the Vulnerable Software and Affected Versions Mofi Network MOFI4500-4GXeLTE version 4.0.8-std

Description An issue was discovered that allows the undocumented system account mofidev to login to the "cgi-bin/luci/quick/wizard" management interface without a password. This is due to a format error in /etc/shadow and a logic bug in the LuCI - OpenWrt Configuration Interface framework, which can be exploited by abusing a forgotten-password feature.

Recommendations For Mofi Network MOFI4500-4GXeLTE version 4.0.8-std, consider disabling access to the cgi-bin/luci/quick/wizard management interface until a patch is available to prevent exploitation of the logic bug in the LuCI framework. Additionally, restrict the use of the undocumented system account mofidev to minimize the risk of unauthorized access.