CVE-2020-12798

Cellebrite UFED 5.0 to 7.5.0.845 implements local operating system policies that can be circumvented to obtain a command prompt via the Windows file dialog that is reachable via the Certificate-Based Authentication option of the Wireless Network Connection screen.

CVSS v3 7.8 HIGH
CVSS v2.0 4.6 MEDIUM

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

4.6^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 3.9 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://packetstormsecurity.com/files/157715/Cellebrite-UFED-7.5.0.845-Desktop-Escape-Privilege-Escalation.html	Exploit Third Party Advisory VDB Entry
https://github.com/thatguylevel	Third Party Advisory
https://korelogic.com/Resources/Advisories/KL-001-2020-002.txt	Exploit Third Party Advisory
https://korelogic.com/advisories.html	Third Party Advisory
https://twitter.com/thatguylevel	Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:sun-denshi:universal_forensic_extraction_device_firmware:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:sun-denshi:universal_forensic_extraction_device_ruggedized_panasonic_laptop:-:::::::*
	cpe:2.3:h:sun-denshi:universal_forensic_extraction_device_touch_2:-:::::::*
	cpe:2.3:h:sun-denshi:universal_forensic_extraction_device_touch_2_ruggedized:-:::::::*

History

No history.

Information

Published : 2020-05-15 18:15

Updated : 2024-02-28 17:47

NVD link : CVE-2020-12798

Mitre link : CVE-2020-12798

CVE.ORG link : CVE-2020-12798

JSON object : View

Products Affected

sun-denshi

universal_forensic_extraction_device_touch_2_ruggedized
universal_forensic_extraction_device_firmware
universal_forensic_extraction_device_touch_2
universal_forensic_extraction_device_ruggedized_panasonic_laptop

CWE

CWE-269

Improper Privilege Management

{"id": "CVE-2020-12798", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.6, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": true, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2020-05-15T18:15:13.587", "references": [{"url": "http://packetstormsecurity.com/files/157715/Cellebrite-UFED-7.5.0.845-Desktop-Escape-Privilege-Escalation.html", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://github.com/thatguylevel", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://korelogic.com/Resources/Advisories/KL-001-2020-002.txt", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://korelogic.com/advisories.html", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://twitter.com/thatguylevel", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "Cellebrite UFED 5.0 to 7.5.0.845 implements local operating system policies that can be circumvented to obtain a command prompt via the Windows file dialog that is reachable via the Certificate-Based Authentication option of the Wireless Network Connection screen."}, {"lang": "es", "value": "Cellebrite UFED versiones 5.0 hasta 7.5.0.845, implementa pol\u00edticas de sistema operativo local que pueden ser evitadas para obtener un s\u00edmbolo del sistema por medio del cuadro de di\u00e1logo de archivos de Windows que es accesible mediante la opci\u00f3n Certificate-Based Authentication de la pantalla Wireless Network Connection."}], "lastModified": "2020-05-21T19:24:22.193", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:sun-denshi:universal_forensic_extraction_device_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0F625B88-3D17-4C2C-85D9-33CF348BD411", "versionEndIncluding": "7.5.0.845", "versionStartIncluding": "5.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:sun-denshi:universal_forensic_extraction_device_ruggedized_panasonic_laptop:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "23F4A774-FA8E-4A70-AD9D-45C53774309E"}, {"criteria": "cpe:2.3:h:sun-denshi:universal_forensic_extraction_device_touch_2:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "80AF0BD1-41BB-41AB-91A3-EB8F011BD4EC"}, {"criteria": "cpe:2.3:h:sun-denshi:universal_forensic_extraction_device_touch_2_ruggedized:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "C543D7A3-5E00-4F5B-A397-C384E8505956"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}