Fruitywifi
Approved changes feed: RSS · Atom
cpe:2.3:a:fruitywifi_project:fruitywifi:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Fruitywifi Project (9b162e5e-e172-58e7-9acb-896ccf54ec2f) |
|---|---|
| Product | Fruitywifi (8ae803b9-d64b-51eb-9ed9-98e7faa91a72) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/xtr4nge/fruitywifi |
purl2cpe | 2026-06-01 10:13:32.445520 |
pkg:gitlab/kalilinux/fruitywifi |
purl2cpe | 2026-06-01 10:13:32.445523 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2020-24849 |
vulnerable | 2026-06-08 05:22:35.672493 |
Details available
A remote code execution vulnerability is identified in FruityWifi through 2.4. Due to improperly escaped shell metacharacters obtained from the POST request at the page_config_adv.php page, it is possible to perform remote code execution by an authenticated attacker. This is similar to CVE-2018-17317.
Published: 2020-11-05T14:19:40.000Z
Updated: 2024-08-04T15:19:09.364Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-24848 |
vulnerable | 2026-06-08 05:22:35.671953 |
Details available
FruityWifi through 2.4 has an unsafe Sudo configuration [(ALL : ALL) NOPASSWD: ALL]. This allows an attacker to perform a system-level (root) local privilege escalation, allowing an attacker to gain complete persistent access to the local system.
Published: 2020-10-23T18:22:49.000Z
Updated: 2024-08-04T15:19:09.340Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-24847 |
vulnerable | 2026-06-08 05:22:35.671440 |
Details available
A Cross-Site Request Forgery (CSRF) vulnerability is identified in FruityWifi through 2.4. Due to a lack of CSRF protection in page_config_adv.php, an unauthenticated attacker can lure the victim to visit his website by social engineering or another attack vector. Due to this issue, an unauthenticated attacker can change the newSSID and hostapd_wpa_passphrase.
Published: 2020-10-23T18:17:12.000Z
Updated: 2024-08-04T15:19:09.341Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-19168 |
vulnerable | 2026-06-08 05:11:15.434361 |
Details available
Shell Metacharacter Injection in www/modules/save.php in FruityWifi (aka PatatasFritas/PatataWifi) through 2.4 allows remote attackers to execute arbitrary code with root privileges via a crafted mod_name parameter in a POST request. NOTE: unlike in CVE-2018-17317, the attacker does not need a valid session.
Published: 2018-11-11T00:00:00.000Z
Updated: 2024-09-16T17:24:20.444Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.