CVE-2020-25195

{"id": "CVE-2020-25195", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2020-12-15T20:15:15.980", "references": [{"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-345-02", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-345-02", "tags": ["Third Party Advisory", "US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-20"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "The length of the input fields of Host Engineering H0-ECOM100, H2-ECOM100, and H4-ECOM100 modules are verified only on the client side when receiving input from the configuration web server, which may allow an attacker to bypass the check and send input to crash the device."}, {"lang": "es", "value": "La longitud de los campos de entrada de los m\u00f3dulos Host Engineering H0-ECOM100, H2-ECOM100 y H4-ECOM100 son verificados solo en el lado del cliente cuando se reciben entradas del servidor web de configuraci\u00f3n, lo que puede permitir a un atacante omitir la comprobaci\u00f3n y enviar entradas para bloquear el dispositivo"}], "lastModified": "2024-11-21T05:17:36.950", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:hosteng:h0-ecom100_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "261A5D3D-8ABC-4A38-85B9-43D49B9F30ED", "versionEndIncluding": "4.0.348"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:hosteng:h0-ecom100:6:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "B5094458-DAF8-49FE-9317-8213649760C4"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:hosteng:h0-ecom100_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7647AB5C-C9AF-4EDC-AD39-9129B462CECC", "versionEndIncluding": "4.1.113"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:hosteng:h0-ecom100:7:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "5800C95C-7CCA-4968-AD90-4258CA389D49"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:hosteng:h0-ecom100_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DED7D3BB-3093-4473-9827-A5750E2C2DA4", "versionEndIncluding": "5.0.149"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:hosteng:h0-ecom100:9:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "01EB51BF-6519-4B01-B253-94855091773A"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:hosteng:h2-ecom100_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1D145662-CCB8-4626-96EF-62C127D2780E", "versionEndIncluding": "4.0.2148"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:hosteng:h2-ecom100:5:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "0FE3FD06-985E-4CEB-AEC4-94FEAA2ABB35"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:hosteng:h2-ecom100_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "35FF4084-D3B2-454F-8D3B-0A55469493A0", "versionEndIncluding": "5.0.1043"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:hosteng:h2-ecom100:8:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "41006F1C-6D13-484E-A150-8CCF44A0465A"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:hosteng:h4-ecom100_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "96566D31-6B83-4695-AF03-C29D275F9D9E", "versionEndIncluding": "4.0.2148"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:hosteng:h4-ecom100:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "63D19A9C-5EC3-4FF0-845E-ECFE11DB7049"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}