Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2020-22724: A remote command execution vulnerability exists in add_server_service of PPTP_SERVER in Mercury Router MER1200 v1.0.1 and Mercury Router MER1200G v1.0.1.

CVE-2020-22724 · published 5 years ago

Summary

A remote command execution vulnerability exists in add_server_service of PPTP_SERVER in Mercury Router MER1200 v1.0.1 and Mercury Router MER1200G v1.0.1.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
mercury	mer1200_firmware	1.0.1 `cpe:2.3:o:mercury:mer1200_firmware:1.0.1:::::::*`
mercury	mer1200g_firmware	1.0.1 `cpe:2.3:o:mercury:mer1200g_firmware:1.0.1:::::::*`

Original advisory text

A remote command execution vulnerability exists in add_server_service of PPTP_SERVER in Mercury Router MER1200 v1.0.1 and Mercury Router MER1200G v1.0.1.

References

https://cwe.mitre.org/data/definitions/78.html Third Party Advisory
https://github.com/DarkEyeR/CVE_Apply/blob/master/Mercury/Mercury%20MER1200%20Ro... Exploit Third Party Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

9.8 Critical

Exploitation

6% chance of attack within 30 days

Type

CWE-78OS Command Injection

Timeline

Published14 Oct 2021

Updated22 Oct 2026

First seen29 Sep 2026

Sources

CVE-2020-22724 · NVD

Track software like this

Free during beta