{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/iq-engine--10.0r8a/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:h:extremenetworks:aerohive_netconfig:*:*:*:*:*:*:*:*","cpe:2.3:h:extremenetworks:aerohive_netconfig:10.0r8a:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2020-16152"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["HiveOS (\u003c 10.0r8a)","IQ Engine (\u003c 10.0r8a)"],"_cs_severities":["high"],"_cs_tags":["lfi","rce","network-infrastructure","extreme-networks"],"_cs_type":"advisory","_cs_vendors":["Extreme Networks"],"content_html":"\u003cp\u003eCVE-2020-16152 is a critical local file inclusion (LFI) vulnerability affecting the administrative web interface (NetConfig) of Extreme Networks HiveOS and IQ Engine versions prior to 10.0r8a. The flaw stems from insufficient input sanitization in the _page parameter of the /action.php5 endpoint, which is used to dynamically load PHP classes. Because the interface relies on an outdated PHP version (5.2.17) that is susceptible to string truncation, an attacker can bypass path restrictions to include arbitrary files.\u003c/p\u003e\n\u003cp\u003eWhen paired with a log poisoning technique, where an attacker injects malicious PHP code into system logs via failed authentication attempts, the LFI vulnerability allows for arbitrary command execution. Critically, the PHP process on these devices runs with root privileges, ensuring that any exploited code grants the attacker full system control. This vulnerability has been publicly documented with functional exploit code, representing a significant risk to unpatched networking infrastructure.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker probes the administrative web interface of a target HiveOS or IQ Engine device, identifying the /action.php5 endpoint.\u003c/li\u003e\n\u003cli\u003eThe attacker performs a failed authentication attempt with a username containing malicious PHP code, which is recorded in the system log file at /tmp/messages.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a request to /action.php5, targeting the _page parameter.\u003c/li\u003e\n\u003cli\u003eThe attacker injects a long path sequence (e.g., repeating slash characters) into the _page parameter to trigger string truncation in the outdated PHP engine, stripping the required '.Access.class.php5' suffix.\u003c/li\u003e\n\u003cli\u003eThe server includes the poisoned log file (/tmp/messages) as if it were a valid PHP class file.\u003c/li\u003e\n\u003cli\u003eThe PHP interpreter executes the injected PHP code contained within the log file.\u003c/li\u003e\n\u003cli\u003eThe command executes with root privileges, granting the attacker complete control over the networking device.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full root-level compromise of the affected network appliance. This allows an attacker to intercept network traffic, modify device configurations, pivot into the internal network, or permanently disrupt critical connectivity. The vulnerability carries a CVSS score of 10.0, indicating the highest level of risk to confidentiality, integrity, and availability.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade Extreme Networks HiveOS and IQ Engine to version 10.0r8a or later immediately to patch the LFI vulnerability.\u003c/li\u003e\n\u003cli\u003eIf an immediate upgrade is not possible, disable the web-based management interface by executing the command 'no system web-server hive-UI enable' via the CLI.\u003c/li\u003e\n\u003cli\u003eMonitor network logs for unusual HTTP POST requests to /action.php5, specifically looking for abnormal strings in the _page parameter that resemble path traversal sequences or PHP code injection.\u003c/li\u003e\n\u003cli\u003eImplement strict access control lists (ACLs) to restrict access to the device management interfaces to authorized IP addresses only.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-19T01:00:18Z","date_published":"2026-10-19T01:00:18Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2020-16152/","summary":"CVE-2020-16152 is a high-severity local file inclusion vulnerability in Extreme Networks HiveOS and IQ Engine that permits root-level remote code execution via log poisoning.","title":"Remote Code Execution in Extreme Networks HiveOS and IQ Engine","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2020-16152/"}],"language":"en","title":"CraftedSignal Threat Feed - IQ Engine (\u003c 10.0r8a)","version":"https://jsonfeed.org/version/1.1"}