CVE-2020-24849: A remote code execution vulnerability is identified in FruityWifi through 2.4.

Security readout for executives and security teams

CVE-2020-24849 lets an authenticated FruityWifi user execute code on the server through unsafe handling of shell metacharacters in a POST request to page_config_adv.php. The public record names FruityWifi through version 2.4. No CVSS score or active exploitation evidence is provided in the supplied sources. Exposure is likely limited to environments running FruityWifi through 2.4, especially where authenticated administrative access is broadly available. The supplied affected-product metadata is incomplete, so confirm against actual deployments and vendor records. Prioritize remediation for any internet-reachable or shared FruityWifi instance because authenticated RCE can lead to server compromise. If FruityWifi is not deployed, record non-exposure and no further action is needed. Mitigation focus: Inventory FruityWifi deployments and identify any versions through 2.4.; Check FruityWifi vendor or GitHub guidance for a fixed version or official workaround.; Restrict access to FruityWifi administrative pages to trusted networks and users..

Prepared

Jun 5, 2026, 13:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.