CVE-2020-7982: openwrt lede
Vulnerability summary
CVE-2020-7982 is a high (CVSS 8.1) vulnerability in openwrt lede. EPSS estimates a 1.60% chance of exploitation in the next 30 days, higher than 75.3% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 16-03-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in OpenWrt 18.06.0 to 18.06.6 and 19.07.0, and LEDE 17.01.0 to 17.01.7. A bug in the fork of the opkg package manager before 2020-01-25 prevents correct parsing of embedded checksums in the signed repository index, allowing a man-in-the-middle attacker to inject arbitrary package payloads (which are installed without verification).
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
1.60%
Chance of exploitation in the next 30 days
Percentile
75%
Versus all other CVEs
30-day change
+0.01 pp
From 1.59% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (blog.forallsecure.com)
Maturity: unknown
Exploit Reference (arstechnica.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-345Insufficient Verification of Data AuthenticityThe product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
- CWE-754Improper Check for Unusual or Exceptional ConditionsThe product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
Affected systems
1 vendor · 2 products
References
4 links- blog.forallsecure.com/uncovering-openwrt-remote-code-execution-cve-2020-7982X Refsource MISCExploitThird Party Advisory
- arstechnica.com/information-technology/…X Refsource MISCExploitPress/Media CoverageThird Party Advisory