PatchTheCVECVE-2020-11963: IQrouter through 3.3.1, when unconfigured, has multiple remote code execution vulnerabilities in the web-panel
CVE-2020-11963 is a critical-severity flaw (CVSS 9.8) affecting iqrouter firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
IQrouter through 3.3.1, when unconfigured, has multiple remote code execution vulnerabilities in the web-panel because of Bash Shell Metacharacter Injection. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration (which has a required step for setting a secure password on the system), makes this CVE invalid. This vulnerability is “true for any unconfigured rele
Why this priority
- Critical severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 3.2% (top 12%) |
| CISA exploited list | No |
| Weakness | CWE-78 |
| Published | 2020-04-21 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2020-11963?
iqrouter firmware: upgrade to newer than 3.3.1. Exact commands for each OS are on this page.
Is CVE-2020-11963 being exploited?
CVE-2020-11963 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2020-11963 affect?
CVE-2020-11963 affects iqrouter firmware. Severity is critical (CVSS 9.8). IQrouter through 3.3.1, when unconfigured, has multiple remote code execution vulnerabilities in the web-panel because of Bash Shell Metacharacter Injection. Note: The vendor claims that this vulnerability can only occur on a brand-new netw
How urgent is CVE-2020-11963?
Priority 61/100. Critical severity; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2020-11968 HIGH 7.5 UPGRADE In the web-panel in IQrouter through 3.3.1, remote attackers can read system logs because of Incorrect Access
- CVE-2020-11967 CRITICAL 9.8 UPGRADE In IQrouter through 3.3.1, remote attackers can control the device (restart network, reboot, upgrade, reset) b
- CVE-2020-11966 CRITICAL 9.8 UPGRADE In IQrouter through 3.3.1, the Lua function reset_password in the web-panel allows remote attackers to change
- CVE-2020-11965 CRITICAL 9.8 UPGRADE In IQrouter through 3.3.1, there is a root user without a password, which allows attackers to gain full remote
- CVE-2020-11964 HIGH 7.5 UPGRADE In IQrouter through 3.3.1, the Lua function diag_set_password in the web-panel allows remote attackers to chan