Lucene search

MitreCVE-2020-11617

HistoryAug 31, 2020 - 3:15 p.m.

CVE-2020-11617

2020-08-3115:15:09

CWE-295

mitre

web.nvd.nist.gov

cve-2020-11617

rss application

thomson

tht741fta

philips

dtr3502bfta

dvb-t2

ssl certificates

man-in-the-middle

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

5.6

Confidence

High

EPSS

0.001

Percentile

30.3%

JSON

The RSS application on THOMSON THT741FTA 2.2.1 and Philips DTR3502BFTA DVB-T2 2.2.1 set-top boxes doesn’t validate the SSL certificates of RSS servers, which allows a man-in-the-middle attacker to modify the data delivered to the client.

Affected configurations

Nvd

Node

thomsonstbtht741ftaMatch-

AND

thomsonstbtht741fta_firmwareMatch2.2.1

Node

philipsdtr3502bfta_dvb-t2Match-

AND

philipsdtr3502bfta_dvb-t2_firmwareMatch2.2.1

VendorProductVersionCPE
thomsonstbtht741fta-cpe:2.3:h:thomsonstb:tht741fta:-:*:*:*:*:*:*:*
thomsonstbtht741fta_firmware2.2.1cpe:2.3:o:thomsonstb:tht741fta_firmware:2.2.1:*:*:*:*:*:*:*
philipsdtr3502bfta_dvb-t2-cpe:2.3:h:philips:dtr3502bfta_dvb-t2:-:*:*:*:*:*:*:*
philipsdtr3502bfta_dvb-t2_firmware2.2.1cpe:2.3:o:philips:dtr3502bfta_dvb-t2_firmware:2.2.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
thomsonstb	tht741fta	-	cpe:2.3:h:thomsonstb:tht741fta:-:::::::*
thomsonstb	tht741fta_firmware	2.2.1	cpe:2.3:o:thomsonstb:tht741fta_firmware:2.2.1:::::::*
philips	dtr3502bfta_dvb-t2	-	cpe:2.3:h:philips:dtr3502bfta_dvb-t2:-:::::::*
philips	dtr3502bfta_dvb-t2_firmware	2.2.1	cpe:2.3:o:philips:dtr3502bfta_dvb-t2_firmware:2.2.1:::::::*

References

decoded.avast.io/vladislaviliushin/flaws-in-dvb-t2-set-top-boxes-exposed/

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

5.6

Confidence

High

EPSS

0.001

Percentile

30.3%

JSON

Related for CVE-2020-11617