{"vulnerability": "cve-2020-16152", "sightings": [{"uuid": "38cae96a-b062-40d6-bf11-c8a4c0f4795b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-16152", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:44.000000Z"}, {"uuid": "e2aeaef2-1813-4bea-b990-e021d564ecd6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-16152", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:25.000000Z"}, {"uuid": "b372783a-d9a6-41d1-acba-d7bd28db326d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-16152", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/aerohive_netconfig_lfi_log_poison_rce.rb", "content": "", "creation_timestamp": "2021-11-11T23:23:32.000000Z"}, {"uuid": "2656422a-654d-450c-ba3c-2b3f2746810f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-16152", "type": "seen", "source": "https://t.me/cibsecurity/32393", "content": "\u203c CVE-2020-16152 \u203c\n\nThe NetConfig UI administrative interface in Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine through 10.0r8a allows attackers to execute PHP code as the root user via remote HTTP requests that insert this code into a log file and then traverse to that file.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-11-15T00:11:50.000000Z"}, {"uuid": "e4f90b21-18d3-4d09-abdd-a566b40afaa1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-16152", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/aerohive_netconfig_lfi_log_poison_rce.rb", "content": "{\"aliases\": [], \"arch\": \"armle, cmd\", \"author\": [\"Erik de Jong\", \"Erik Wynter\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits LFI and log poisoning vulnerabilities\\n          (CVE-2020-16152) in Aerohive NetConfig, version 10.0r8a\\n          build-242466 and older in order to achieve unauthenticated remote\\n          code execution as the root user. NetConfig is the Aerohive/Extreme\\n          Networks HiveOS administrative webinterface. Vulnerable versions\\n          allow for LFI because they rely on a version of PHP 5 that is\\n          vulnerable to string truncation attacks. This module leverages this\\n          issue in conjunction with log poisoning to gain RCE as root.\\n\\n          Upon successful exploitation, the Aerohive NetConfig application\\n          may hang for as long as the spawned shell remains open. For the\\n          Linux target, the MeterpreterTryToFork option (enabled by default)\\n          will likely prevent this. If the app hangs, closing the session\\n          should render it responsive again.\\n\\n          The module provides an automatic cleanup option to clean the log.\\n          However, this option is disabled by default because any modifications\\n          to the /tmp/messages log, even via sed, may render the target\\n          (temporarily) unexploitable. This state can last over an hour.\\n\\n          This module has been successfully tested against Aerohive NetConfig\\n          versions 8.2r4 and 10.0r7a.\", \"disclosure_date\": \"2020-02-17\", \"fullname\": \"exploit/unix/webapp/aerohive_netconfig_lfi_log_poison_rce\", \"is_install_path\": true, \"mod_time\": \"2025-12-17 16:12:31 +0000\", \"name\": \"Aerohive NetConfig 10.0r8a LFI and log poisoning to RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/unix/webapp/aerohive_netconfig_lfi_log_poison_rce.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"unix/webapp/aerohive_netconfig_lfi_log_poison_rce\", \"references\": [\"CVE-2020-16152\", \"URL-https://github.com/eriknl/CVE-2020-16152\"], \"rport\": 443, \"session_types\": false, \"targets\": [\"Linux\", \"CMD\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:40.003001Z"}]}