CVE-2020-12246

8.8 highEPSS 4.9%

High (8.8) in beeline smart box firmware. EPSS 4.9% chance of exploitation in the next 30 days.

Beeline Smart Box 2.0.38 routers allow "Advanced settings > Other > Diagnostics" OS command injection via the Ping ping_ipaddr parameter, the Nslookup nslookup_ipaddr parameter, or the Traceroute traceroute_ipaddr parameter.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 4.9% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-10-31)
CWE: CWE-78
Published: 2020-04-29
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

beeline:smart_box_firmware

References

https://medium.com/%40Pavel.Step/security-analysis-of-the-smart-box-router-932f86dc8a9e
https://yadi.sk/i/YdfXr-ofAN2ZWA
https://yadi.sk/i/iIUCJVaGEuSaAw
https://yadi.sk/i/jXV87yn4ZJfSHA
https://medium.com/%40Pavel.Step/security-analysis-of-the-smart-box-router-932f86dc8a9e

Check your stack JSON