CVE-2020-13856

An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. Authentication is not required to download the support file that contains sensitive information such as cleartext credentials and password hashes.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://mofinetwork.com/index.php?main_page=page&id=14	Patch Vendor Advisory
https://www.criticalstart.com/critical-vulnerabilities-discovered-in-mofi-routers/	Technical Description Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:mofinetwork:mofi4500-4gxelte_firmware:4.0.8-std:*:*:*:*:*:*:*

cpe:2.3:h:mofinetwork:mofi4500-4gxelte:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2021-02-01 02:15

Updated : 2024-02-28 18:08

NVD link : CVE-2020-13856

Mitre link : CVE-2020-13856

CVE.ORG link : CVE-2020-13856

JSON object : View

Products Affected

mofinetwork

mofi4500-4gxelte
mofi4500-4gxelte_firmware

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2020-13856", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2021-02-01T02:15:12.517", "references": [{"url": "https://mofinetwork.com/index.php?main_page=page&id=14", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.criticalstart.com/critical-vulnerabilities-discovered-in-mofi-routers/", "tags": ["Technical Description", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. Authentication is not required to download the support file that contains sensitive information such as cleartext credentials and password hashes."}, {"lang": "es", "value": "Se detect\u00f3 un problema en los dispositivos Mofi Network MOFI4500-4GXeLTE versi\u00f3n 4.0.8-std. No se requiere autenticaci\u00f3n para descargar el archivo de soporte que contiene informaci\u00f3n confidencial, como credenciales de texto sin cifrar y hashes de contrase\u00f1a"}], "lastModified": "2021-07-21T11:39:23.747", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:mofinetwork:mofi4500-4gxelte_firmware:4.0.8-std:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B22253CC-AFEF-4A42-8ED9-5B5348F5937A"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:mofinetwork:mofi4500-4gxelte:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "8C7B2A7E-0E09-412C-B540-9C5DFD16767D"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}