CVE-2020-16152
The NetConfig UI administrative interface in Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine through 10.0r8a allows attackers to execute PHP...
- Published
- Nov 14, 2021
- Updated
- Aug 4, 2024
- Assigning CNA
- mitre
- Evidence observed
- Aug 8, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HModerate · next 30 days
- Percentile
- 98.4%
- Model date
- Oct 16, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
The NetConfig UI administrative interface in Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine through 10.0r8a allows attackers to execute PHP code as the root user via remote HTTP requests that insert this code into a log file and then traverse to that file.
Sources
modules/exploits/unix/webapp/aerohive_netconfig_lfi_log_poison_rce.rb
Metasploit Framework modulesDeclared conditions
- platform: Linux,Unix($.exploit_unix/webapp/aerohive_netconfig_lfi_log_poison_rce.platform)
- verification: check_declared($.exploit_unix/webapp/aerohive_netconfig_lfi_log_poison_rce.check)
- CVE-2020-16152Exploit
Proof-of-concept exploit for CVE-2020-16152: LFI-to-RCE in Aerohive/Extreme Networks HiveOS via PHP string truncation and log poisoning, enabling root access on vulnerable access points.
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.