Lucene search

TwcertCVE-2020-24552

HistorySep 10, 2020 - 9:15 a.m.

CVE-2020-24552

2020-09-1009:15:12

CWE-78

twcert

web.nvd.nist.gov

atop technology

gateway

command injection

vulnerability

nvd

cve-2020-24552

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.4

Confidence

High

EPSS

0.001

Percentile

45.2%

JSON

Atop Technology industrial 3G/4G gateway contains Command Injection vulnerability. Due to insufficient input validation, the device’s web management interface allows attackers to inject specific code and execute system commands without privilege.

Affected configurations

Nvd

Node

atoptechnologyse5901Match-

AND

atoptechnologyse5901_firmwareRange1.18–1.40

Node

atoptechnologyse5901bMatch-

AND

atoptechnologyse5901b_firmwareRange1.18–1.40

Node

atoptechnologyse5904dMatch-

AND

atoptechnologyse5904d_firmwareRange1.18–1.40

Node

atoptechnologyse5908Match-

AND

atoptechnologyse5908_firmwareRange1.18–1.40

Node

atoptechnologyse5908aMatch-

AND

atoptechnologyse5908a_firmwareRange1.18–1.40

Node

atoptechnologyse5916Match-

AND

atoptechnologyse5916_firmwareRange1.18–1.40

Node

atoptechnologyse5916aMatch-

AND

atoptechnologyse5916a_firmwareRange1.18–1.40

VendorProductVersionCPE
atoptechnologyse5901-cpe:2.3:h:atoptechnology:se5901:-:*:*:*:*:*:*:*
atoptechnologyse5901_firmware*cpe:2.3:o:atoptechnology:se5901_firmware:*:*:*:*:*:*:*:*
atoptechnologyse5901b-cpe:2.3:h:atoptechnology:se5901b:-:*:*:*:*:*:*:*
atoptechnologyse5901b_firmware*cpe:2.3:o:atoptechnology:se5901b_firmware:*:*:*:*:*:*:*:*
atoptechnologyse5904d-cpe:2.3:h:atoptechnology:se5904d:-:*:*:*:*:*:*:*
atoptechnologyse5904d_firmware*cpe:2.3:o:atoptechnology:se5904d_firmware:*:*:*:*:*:*:*:*
atoptechnologyse5908-cpe:2.3:h:atoptechnology:se5908:-:*:*:*:*:*:*:*
atoptechnologyse5908_firmware*cpe:2.3:o:atoptechnology:se5908_firmware:*:*:*:*:*:*:*:*
atoptechnologyse5908a-cpe:2.3:h:atoptechnology:se5908a:-:*:*:*:*:*:*:*
atoptechnologyse5908a_firmware*cpe:2.3:o:atoptechnology:se5908a_firmware:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
atoptechnology	se5901	-	cpe:2.3:h:atoptechnology:se5901:-:::::::*
atoptechnology	se5901_firmware	*	cpe:2.3:o:atoptechnology:se5901_firmware::::::::
atoptechnology	se5901b	-	cpe:2.3:h:atoptechnology:se5901b:-:::::::*
atoptechnology	se5901b_firmware	*	cpe:2.3:o:atoptechnology:se5901b_firmware::::::::
atoptechnology	se5904d	-	cpe:2.3:h:atoptechnology:se5904d:-:::::::*
atoptechnology	se5904d_firmware	*	cpe:2.3:o:atoptechnology:se5904d_firmware::::::::
atoptechnology	se5908	-	cpe:2.3:h:atoptechnology:se5908:-:::::::*
atoptechnology	se5908_firmware	*	cpe:2.3:o:atoptechnology:se5908_firmware::::::::
atoptechnology	se5908a	-	cpe:2.3:h:atoptechnology:se5908a:-:::::::*
atoptechnology	se5908a_firmware	*	cpe:2.3:o:atoptechnology:se5908a_firmware::::::::

Rows per page:

1-10 of 141

CNA Affected

[
  {
    "product": "3G/4G LTE Cellular to Ethernet and Serial Secure Industrial Gateway SE5901",
    "vendor": "Atop Technology",
    "versions": [
      {
        "lessThanOrEqual": "1.4",
        "status": "affected",
        "version": "1.18",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "3G/4G LTE Cellular to Ethernet and Serial Secure Industrial Gateway SE5901B",
    "vendor": "Atop Technology",
    "versions": [
      {
        "lessThanOrEqual": "1.4",
        "status": "affected",
        "version": "1.18",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "3G/4G LTE Cellular to Ethernet and Serial Secure Industrial Gateway SE5904D",
    "vendor": "Atop Technology",
    "versions": [
      {
        "lessThanOrEqual": "1.4",
        "status": "affected",
        "version": "1.18",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "3G/4G LTE Cellular to Ethernet and Serial Secure Industrial Gateway SE5908",
    "vendor": "Atop Technology",
    "versions": [
      {
        "status": "affected",
        "version": "1.18 1.4"
      }
    ]
  },
  {
    "product": "3G/4G LTE Cellular to Ethernet and Serial Secure Industrial Gateway SE5908A",
    "vendor": "Atop Technology",
    "versions": [
      {
        "status": "affected",
        "version": "1.18 1.4"
      }
    ]
  },
  {
    "product": "3G/4G LTE Cellular to Ethernet and Serial Secure Industrial Gateway SE5916",
    "vendor": "Atop Technology",
    "versions": [
      {
        "status": "affected",
        "version": "1.18 1.4"
      }
    ]
  },
  {
    "product": "3G/4G LTE Cellular to Ethernet and Serial Secure Industrial Gateway SE5916A",
    "vendor": "Atop Technology",
    "versions": [
      {
        "status": "affected",
        "version": "1.18 1.4"
      }
    ]
  }
]

References

www.twcert.org.tw/tw/cp-132-3956-608f1-1.html

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.4

Confidence

High

EPSS

0.001

Percentile

45.2%

JSON

Related for CVE-2020-24552