CVE-2020-29669

{"id": "CVE-2020-29669", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2020-12-14T02:15:11.453", "references": [{"url": "http://packetstormsecurity.com/files/160478/Macally-WIFISD2-2A82-2.000.010-Privilege-Escalation.html", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://drive.google.com/file/d/1PpiRhhfph8U_0KAoIp0AnwY3mVtp-R-g/view", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/S1lkys/CVE-2020-29669", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "In the Macally WIFISD2-2A82 Media and Travel Router 2.000.010, the Guest user is able to reset its own password. This process has a vulnerability which can be used to take over the administrator account and results in shell access. As the admin user may read the /etc/shadow file, the password hashes of each user (including root) can be dumped. The root hash can be cracked easily which results in a complete system compromise."}, {"lang": "es", "value": "En el Macally WIFISD2-2A82 Media and Travel Router versi\u00f3n 2.000.010, el usuario Invitado puede restablecer su propia contrase\u00f1a. Este proceso presenta una vulnerabilidad que puede ser usada para tomar control de la cuenta de administrador y resultar en un acceso de shell. Como el usuario administrador puede leer el archivo /etc/shadow, los hash de contrase\u00f1a de cada usuario (incluyendo el root) pueden ser perdidos. El hash root puede ser descifrado f\u00e1cilmente, lo que resulta en un compromiso completo del sistema."}], "lastModified": "2020-12-15T23:46:11.240", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:macally:wifisd2-2a82_firmware:2.000.010:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D22E2897-21B1-4543-916C-5EC96A5C2D32"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:macally:wifisd2-2a82:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "5FF35DC3-642A-4EBE-8005-FD6336BF56B0"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}