PatchTheCVEopenwebif vulnerabilities and fixes
Recent CVEs affecting openwebif, with upgrade or downgrade steps. 4 tracked.
openwebif has 4 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 3. Most recent: 2021-08-04. Highest priority: CVE-2017-9807 (score 67/100).
- CVE-2021-38113 MEDIUM 5.4 UPGRADE In addBouquet in js/bqe.js in OpenWebif (aka e2openplugin-OpenWebif) through 1.4.7, inserting JavaScript into
- CVE-2018-20332 HIGH 7.5 UPGRADE An issue has been discovered in the OpenWebif plugin through 1.2.4 for Enigma2 based devices
- CVE-2017-9807 CRITICAL 9.8 UPGRADE An issue was discovered in the OpenWebif plugin through 1.2.4 for E2 open devices
- CVE-2017-9333 HIGH 8.8 DOWNGRADE OpenWebif 1.2.5 allows remote code execution via a URL to the CallOPKG function in the IpkgController class in
FAQ
How do I fix openwebif vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is openwebif being exploited right now?
None of the tracked openwebif CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which openwebif CVE should I patch first?
CVE-2017-9807 currently ranks highest (67/100): An issue was discovered in the OpenWebif plugin through 1.2.4 for E2 open devices.