CVE-2020-8810

An issue was discovered in Gurux GXDLMS Director through 8.5.1905.1301. When downloading OBIS codes, it does not verify that the downloaded files are actual OBIS codes and doesn't check for path traversal. This allows the attacker exploiting CVE-2020-8809 to send executable files and place them in an autorun directory, or to place DLLs inside the existing GXDLMS Director installation (run on next execution of GXDLMS Director). This can be used to achieve code execution even if the user doesn't have any add-ins installed.

CVSS v3 8.1 HIGH
CVSS v2.0 6.8 MEDIUM

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/seqred-s-a/gxdlmsdirector-cve	Exploit Third Party Advisory
https://seqred.pl/en/cve-gurux-gxdlms-director/	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:gurux:device_language_message_specification_director:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-02-25 19:15

Updated : 2024-02-28 17:28

NVD link : CVE-2020-8810

Mitre link : CVE-2020-8810

CVE.ORG link : CVE-2020-8810

JSON object : View

Products Affected

gurux

device_language_message_specification_director

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2020-8810", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "published": "2020-02-25T19:15:11.880", "references": [{"url": "https://github.com/seqred-s-a/gxdlmsdirector-cve", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://seqred.pl/en/cve-gurux-gxdlms-director/", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Gurux GXDLMS Director through 8.5.1905.1301. When downloading OBIS codes, it does not verify that the downloaded files are actual OBIS codes and doesn't check for path traversal. This allows the attacker exploiting CVE-2020-8809 to send executable files and place them in an autorun directory, or to place DLLs inside the existing GXDLMS Director installation (run on next execution of GXDLMS Director). This can be used to achieve code execution even if the user doesn't have any add-ins installed."}, {"lang": "es", "value": "Se detect\u00f3 un problema en Gurux GXDLMS Director versiones hasta 8.5.1905.1301. Cuando se descargan c\u00f3digos OBIS, no verifica que los archivos descargados sean c\u00f3digos OBIS reales y no comprueba el salto de ruta. Esto permite a un atacante explotar el CVE-2020-8809 al enviar archivos ejecutables y colocarlos en un directorio autorun, o colocar bibliotecas DLL dentro de la instalaci\u00f3n existente de GXDLMS Director (correr en la pr\u00f3xima ejecuci\u00f3n del GXDLMS Director). Esto puede ser usado para lograr una ejecuci\u00f3n de c\u00f3digo incluso si el usuario no tiene ning\u00fan add-ins instalado."}], "lastModified": "2020-03-04T21:27:07.373", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gurux:device_language_message_specification_director:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9D931C54-0AB4-4DDE-8A4F-83A6900169CC", "versionEndIncluding": "8.5.1905.1301"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}