7.5

CVE-2020-21997

Exploit
Smartwares HOME easy <=1.0.9 is vulnerable to an unauthenticated database backup download and information disclosure vulnerability. An attacker could disclose sensitive and clear-text information resulting in authentication bypass, session hijacking and full system control.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Smartwares ≫ Home Easy Firmware Version <= 1.0.9
   Smartwares ≫ Home Easy Version-
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.72% 0.841
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

https://cwe.mitre.org/data/definitions/306.html
Third Party Advisory
https://www.exploit-db.com/exploits/47596
Third Party Advisory
Exploit
VDB Entry
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5541.php
Third Party Advisory
Exploit