CVE-2020-12493

An open port used for debugging in SWARCOs CPU LS4000 Series with versions starting with G4... grants root access to the device without access control via network. A malicious user could use this vulnerability to get access to the device and disturb operations with connected devices.

CVSS v3 10.0 CRITICAL
CVSS v2.0 10.0 HIGH

10.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://cert.vde.com/de-de/advisories/vde-2020-016	Third Party Advisory
https://cert.vde.com/de-de/advisories/vde-2020-016	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:o:swarco:cpu_ls4000_firmware:g4:*:*:*:*:*:*:*

History

21 Nov 2024, 04:59

Type	Values Removed	Values Added
References	~~() https://cert.vde.com/de-de/advisories/vde-2020-016 - Third Party Advisory~~	() https://cert.vde.com/de-de/advisories/vde-2020-016 - Third Party Advisory

Information

Published : 2020-05-29 18:15

Updated : 2024-11-21 04:59

NVD link : CVE-2020-12493

Mitre link : CVE-2020-12493

CVE.ORG link : CVE-2020-12493

JSON object : View

Products Affected

swarco

cpu_ls4000_firmware

CWE

CWE-284

Improper Access Control

NVD-CWE-Other

{"id": "CVE-2020-12493", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "info@cert.vde.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}]}, "published": "2020-05-29T18:15:11.127", "references": [{"url": "https://cert.vde.com/de-de/advisories/vde-2020-016", "tags": ["Third Party Advisory"], "source": "info@cert.vde.com"}, {"url": "https://cert.vde.com/de-de/advisories/vde-2020-016", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "info@cert.vde.com", "description": [{"lang": "en", "value": "CWE-284"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "An open port used for debugging in SWARCOs CPU LS4000 Series with versions starting with G4... grants root access to the device without access control via network. A malicious user could use this vulnerability to get access to the device and disturb operations with connected devices."}, {"lang": "es", "value": "Un puerto abierto usado para una depuraci\u00f3n en SWARCOs CPU LS4000 Series con versiones que comienzan con G4... otorga acceso root al dispositivo sin control de acceso por medio de la red. Un usuario malicioso podr\u00eda usar esta vulnerabilidad para conseguir acceso al dispositivo y perturbar las operaciones con los dispositivos conectados."}], "lastModified": "2024-11-21T04:59:47.777", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:swarco:cpu_ls4000_firmware:g4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1E05EEB8-6B67-4D78-8767-317E7B177375"}], "operator": "OR"}]}], "sourceIdentifier": "info@cert.vde.com"}