CVE-2020-16205

Exploit

EPSS 55.18%
Veröffentlicht 14.08.2020 14:15:12
Zuletzt bearbeitet 21.11.2024 05:06:55
Quelle ics-cert@hq.dhs.gov
CVE-Watchlists
Login
Unerledigt
Login

Using a specially crafted URL command, a remote authenticated user can execute commands as root on the G-Cam and G-Code (Firmware Versions 1.12.0.25 and prior as well as the limited Versions 1.12.13.2 and 1.12.14.5).

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 5

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Geutebrueck ≫ G-cam Ebc-2110 Firmware Version1.12.0.25

   Geutebrueck ≫ G-cam Ebc-2110 Version-
   Geutebrueck ≫ G-cam Ebc-2111 Version-
   Geutebrueck ≫ G-cam Efd-2240 Version-
   Geutebrueck ≫ G-cam Efd-2241 Version-
   Geutebrueck ≫ G-cam Efd-2250 Version-
   Geutebrueck ≫ G-cam Ethc-2230 Version-
   Geutebrueck ≫ G-cam Ethc-2239 Version-
   Geutebrueck ≫ G-cam Ethc-2240 Version-
   Geutebrueck ≫ G-cam Ethc-2249 Version-
   Geutebrueck ≫ G-cam Ewpc-2270 Version-
   Geutebrueck ≫ G-code Eec-2400 Version-

Geutebrueck ≫ G-cam Ebc-2110 Firmware Version1.12.13.2

Geutebrueck ≫ G-cam Ebc-2110 Firmware Version1.12.14.5

Geutebrueck ≫ G-cam Ebc-2111 Firmware Version1.12.0.25

Geutebrueck ≫ G-cam Ebc-2111 Firmware Version1.12.13.2

Geutebrueck ≫ G-cam Ebc-2111 Firmware Version1.12.14.5

Geutebrueck ≫ G-cam Efd-2240 Firmware Version1.12.0.25

Geutebrueck ≫ G-cam Efd-2240 Firmware Version1.12.13.2

Geutebrueck ≫ G-cam Efd-2240 Firmware Version1.12.14.5

Geutebrueck ≫ G-cam Efd-2241 Firmware Version1.12.0.25

Geutebrueck ≫ G-cam Efd-2241 Firmware Version1.12.13.2

Geutebrueck ≫ G-cam Efd-2241 Firmware Version1.12.14.5

Geutebrueck ≫ G-cam Efd-2250 Firmware Version1.12.0.25

Geutebrueck ≫ G-cam Efd-2250 Firmware Version1.12.13.2

Geutebrueck ≫ G-cam Efd-2250 Firmware Version1.12.14.5

Geutebrueck ≫ G-cam Ethc-2230 Firmware Version1.12.0.25

Geutebrueck ≫ G-cam Ethc-2230 Firmware Version1.12.13.2

Geutebrueck ≫ G-cam Ethc-2230 Firmware Version1.12.14.5

Geutebrueck ≫ G-cam Ethc-2239 Firmware Version1.12.0.25

Geutebrueck ≫ G-cam Ethc-2239 Firmware Version1.12.13.2

Geutebrueck ≫ G-cam Ethc-2239 Firmware Version1.12.14.5

Geutebrueck ≫ G-cam Ethc-2240 Firmware Version1.12.0.25

Geutebrueck ≫ G-cam Ethc-2240 Firmware Version1.12.13.2

Geutebrueck ≫ G-cam Ethc-2240 Firmware Version1.12.14.5

Geutebrueck ≫ G-cam Ethc-2249 Firmware Version1.12.0.25

Geutebrueck ≫ G-cam Ethc-2249 Firmware Version1.12.13.2

Geutebrueck ≫ G-cam Ethc-2249 Firmware Version1.12.14.5

Geutebrueck ≫ G-cam Ewpc-2270 Firmware Version1.12.0.25

Geutebrueck ≫ G-cam Ewpc-2270 Firmware Version1.12.13.2

Geutebrueck ≫ G-cam Ewpc-2270 Firmware Version1.12.14.5

Geutebrueck ≫ G-code Eec-2400 Firmware Version1.12.0.25

Geutebrueck ≫ G-code Eec-2400 Firmware Version1.12.13.2

Geutebrueck ≫ G-code Eec-2400 Firmware Version1.12.14.5

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	55.18%	0.979

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	7.2	1.2	5.9	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	9	8	10	AV:N/AC:L/Au:S/C:C/I:C/A:C

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

http://packetstormsecurity.com/files/158888/Geutebruck-testaction.cgi-Remote-Command-Execution.html

Third Party Advisory

Exploit

https://us-cert.cisa.gov/ics/advisories/icsa-20-219-03

Third Party Advisory

US Government Resource

https://nvd.nist.gov/vuln/detail/CVE-2020-16205

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2020-16205

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2020-16205

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2020-16205