CVE-2020-24034

{"id": "CVE-2020-24034", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2020-09-01T18:15:13.587", "references": [{"url": "http://packetstormsecurity.com/files/159026/Sagemcom-F-ST-5280-Privilege-Escalation.html", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://seclists.org/fulldisclosure/2020/Sep/3", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://seclists.org/fulldisclosure/2020/Sep/3", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://support.sagemcom.com/fr/haut-debit", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "Sagemcom F@ST 5280 routers using firmware version 1.150.61 have insecure deserialization that allows any authenticated user to perform a privilege escalation to any other user. By making a request with valid sess_id, nonce, and ha1 values inside of the serialized session cookie, an attacker may alter the user value inside of this cookie, and assume the role and permissions of the user specified. By assuming the role of the user internal, which is inaccessible to end users by default, the attacker gains the permissions of the internal account, which includes the ability to flash custom firmware to the router, allowing the attacker to achieve a complete compromise."}, {"lang": "es", "value": "Los enrutadores Sagemcom F@ST 5280 que utilizan la versi\u00f3n de firmware 1.150.61, presentan una deserializaci\u00f3n no segura que permite a cualquier usuario autenticado llevar a cabo una escalada de privilegios a cualquier otro usuario. Al hacer una petici\u00f3n con valores v\u00e1lidos sess_id, nonce y ha1 dentro de la cookie de sesi\u00f3n serializada, un atacante puede alterar el valor de usuario dentro de esta cookie y asumir el rol y los permisos del usuario especificado. Al asumir el rol de usuario interno, que es inaccesible para los usuarios finales por defecto, el atacante consigue los permisos de la cuenta interna, que incluye la capacidad de actualizar firmware personalizado en el enrutador, permitiendo al atacante lograr un compromiso completo"}], "lastModified": "2020-09-11T14:36:29.563", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:sagemcom:f\\@st_5280_router_firmware:1.150.61:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2C56292D-8A79-4029-B8AE-E92DA3B4529E"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:sagemcom:f\\@st_5280_router:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D6461A37-E57A-4D05-8C7E-ED25A7C9566D"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}