CVE-2020-22159
📋 TL;DR
This vulnerability allows authenticated attackers to upload arbitrary files to EVERTZ devices, potentially enabling webshell deployment or critical system file overwrites. It affects specific EVERTZ hardware models running vulnerable firmware versions. Organizations using these devices for multicast video transport are at risk.
💻 Affected Systems
- EVERTZ 3080IPX
- EVERTZ 7801FC
- EVERTZ 7890IXG
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise leading to persistent remote access, data exfiltration, or device bricking through critical file overwrites.
Likely Case
Unauthorized file upload leading to webshell installation for command execution and lateral movement within the network.
If Mitigated
Limited impact with proper network segmentation and authentication controls preventing unauthorized access.
🎯 Exploit Status
Exploitation requires authentication but is straightforward once access is obtained. Public blog posts demonstrate the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not publicly available
Restart Required: No
Instructions:
Contact EVERTZ support for firmware updates. No public patch information available at this time.
🔧 Temporary Workarounds
Network Segmentation
allIsolate EVERTZ devices from untrusted networks and restrict access to management interfaces.
Authentication Hardening
allChange default credentials and implement strong authentication policies.
🧯 If You Can't Patch
- Implement strict network access controls allowing only trusted IPs to connect to management interfaces
- Monitor file upload activities and implement file integrity monitoring on critical system files
🔍 How to Verify
Check if Vulnerable:
Check device firmware version against affected versions. Test authenticated file upload functionality for path traversal.Check Version:
Check via device web interface or CLI (device-specific commands vary)Verify Fix Applied:
Verify firmware has been updated to a version not listed in affected versions. Test file upload functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual file upload activities
- Authentication attempts from unexpected sources
- File modification timestamps on critical system files
Network Indicators:
- HTTP POST requests to file upload endpoints
- Unexpected outbound connections from devices
SIEM Query:
source="evertz_device" AND (event="file_upload" OR event="file_modification")🔗 References
- https://cacharros-inthewild.blogspot.com/2023/07/the-3080ipx-is-integrated-multicast.html
- https://sku11army.blogspot.com/2020/02/evertz-path-transversal-arbitrary-file.html
- https://cacharros-inthewild.blogspot.com/2023/07/the-3080ipx-is-integrated-multicast.html
- https://sku11army.blogspot.com/2020/02/evertz-path-transversal-arbitrary-file.html
