CVE-2020-8233
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:S/C:C/I:C/A:C
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
73.9%
A command injection vulnerability exists in EdgeSwitch firmware <v1.9.0 that allowed an authenticated read-only user to execute arbitrary shell commands over the HTTP interface, allowing them to escalate privileges.
Affected configurations
| Vendor | Product | Version | CPE |
|---|---|---|---|
| ui | edgeswitch_firmware | * | cpe:2.3:a:ui:edgeswitch_firmware:*:*:*:*:*:*:*:* |
| ui | ep-16-xg | - | cpe:2.3:h:ui:ep-16-xg:-:*:*:*:*:*:*:* |
| ui | ep-s16 | - | cpe:2.3:h:ui:ep-s16:-:*:*:*:*:*:*:* |
| ui | es-12f | - | cpe:2.3:h:ui:es-12f:-:*:*:*:*:*:*:* |
| ui | es-16-150w | - | cpe:2.3:h:ui:es-16-150w:-:*:*:*:*:*:*:* |
| ui | es-24-250w | - | cpe:2.3:h:ui:es-24-250w:-:*:*:*:*:*:*:* |
| ui | es-24-500w | - | cpe:2.3:h:ui:es-24-500w:-:*:*:*:*:*:*:* |
| ui | es-24-lite | - | cpe:2.3:h:ui:es-24-lite:-:*:*:*:*:*:*:* |
| ui | es-48-500w | - | cpe:2.3:h:ui:es-48-500w:-:*:*:*:*:*:*:* |
| ui | es-48-750w | - | cpe:2.3:h:ui:es-48-750w:-:*:*:*:*:*:*:* |
References
Related
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:S/C:C/I:C/A:C
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
73.9%