CVE-2020-8809

Gurux GXDLMS Director prior to 8.5.1905.1301 downloads updates to add-ins and OBIS code over an unencrypted HTTP connection. A man-in-the-middle attacker can prompt the user to download updates by modifying the contents of gurux.fi/obis/files.xml and gurux.fi/updates/updates.xml. Then, the attacker can modify the contents of downloaded files. In the case of add-ins (if the user is using those), this will lead to code execution. In case of OBIS codes (which the user is always using as they are needed to communicate with the energy meters), this can lead to code execution when combined with CVE-2020-8810.

CVSS v3 8.1 HIGH
CVSS v2.0 6.8 MEDIUM

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/seqred-s-a/gxdlmsdirector-cve	Exploit Third Party Advisory
https://seqred.pl/en/cve-gurux-gxdlms-director/	Exploit Third Party Advisory
https://github.com/seqred-s-a/gxdlmsdirector-cve	Exploit Third Party Advisory
https://seqred.pl/en/cve-gurux-gxdlms-director/	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:gurux:device_language_message_specification_director:*:*:*:*:*:*:*:*

History

21 Nov 2024, 05:39

Type	Values Removed	Values Added
References	~~() https://github.com/seqred-s-a/gxdlmsdirector-cve - Exploit, Third Party Advisory~~	() https://github.com/seqred-s-a/gxdlmsdirector-cve - Exploit, Third Party Advisory
References	~~() https://seqred.pl/en/cve-gurux-gxdlms-director/ - Exploit, Third Party Advisory~~	() https://seqred.pl/en/cve-gurux-gxdlms-director/ - Exploit, Third Party Advisory

Information

Published : 2020-02-25 19:15

Updated : 2024-11-21 05:39

NVD link : CVE-2020-8809

Mitre link : CVE-2020-8809

CVE.ORG link : CVE-2020-8809

JSON object : View

Products Affected

gurux

device_language_message_specification_director

CWE

CWE-494

Download of Code Without Integrity Check

{"id": "CVE-2020-8809", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "published": "2020-02-25T19:15:11.817", "references": [{"url": "https://github.com/seqred-s-a/gxdlmsdirector-cve", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://seqred.pl/en/cve-gurux-gxdlms-director/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/seqred-s-a/gxdlmsdirector-cve", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://seqred.pl/en/cve-gurux-gxdlms-director/", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-494"}]}], "descriptions": [{"lang": "en", "value": "Gurux GXDLMS Director prior to 8.5.1905.1301 downloads updates to add-ins and OBIS code over an unencrypted HTTP connection. A man-in-the-middle attacker can prompt the user to download updates by modifying the contents of gurux.fi/obis/files.xml and gurux.fi/updates/updates.xml. Then, the attacker can modify the contents of downloaded files. In the case of add-ins (if the user is using those), this will lead to code execution. In case of OBIS codes (which the user is always using as they are needed to communicate with the energy meters), this can lead to code execution when combined with CVE-2020-8810."}, {"lang": "es", "value": "Gurux GXDLMS Director versiones anteriores a 8.5.1905.1301, descarga actualizaciones para add-ins y c\u00f3digo OBIS por medio de una conexi\u00f3n HTTP sin cifrar. Un atacante de tipo man-in-the-middle puede solicitar al usuario que descargue actualizaciones modificando el contenido de los archivos gurux.fi/obis/files.xml y gurux.fi/updates/updates.xml. Luego, el atacante puede modificar el contenido de los archivos descargados. En el caso de add-ins (si el usuario los est\u00e1 utilizando), esto conllevar\u00e1 a una ejecuci\u00f3n de c\u00f3digo. En el caso de los c\u00f3digos OBIS (que el usuario siempre usa, ya que son necesarios para comunicarse con los medidores de energ\u00eda), esto puede conllevar a una ejecuci\u00f3n de c\u00f3digo cuando se combina con CVE-2020-8810."}], "lastModified": "2024-11-21T05:39:28.903", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gurux:device_language_message_specification_director:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "07D9B2FA-2B52-40C6-9FDE-321F932B18EC", "versionEndExcluding": "8.5.1905.1301"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}