Design/Logic Flaw

2020-02-2704:15:00

PRIOn knowledge base

www.prio-n.com

9.5 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.9%

JSON

DVR firmware in TAT-76 and TAT-77 series of products, provided by TONNET do not properly verify patch files. Attackers can inject a specific command into a patch file and gain access to the system.

CPENameOperatorVersion
tat-70432n_firmwareeq<= tat77208g120181225
tat-71416g1_firmwareeq<= tat71416g120181225
tat-71832g1_firmwareeq<= tat71832g120190510
tat-76104g3_firmwareeq<= 20181220-76104g3
tat-76108g3_firmwareeq<= 20181221-76208g3
tat-76116g3_firmwareeq<= 20181221-76216g3
tat-76132g3_firmwareeq<= tat70832g3201812211
tat-77104g1_firmwareeq<= tat77104g120190107

Name	Operator	Version
tat-70432n_firmware	eq	<= tat77208g120181225
tat-71416g1_firmware	eq	<= tat71416g120181225
tat-71832g1_firmware	eq	<= tat71832g120190510
tat-76104g3_firmware	eq	<= 20181220-76104g3
tat-76108g3_firmware	eq	<= 20181221-76208g3
tat-76116g3_firmware	eq	<= 20181221-76216g3
tat-76132g3_firmware	eq	<= tat70832g3201812211
tat-77104g1_firmware	eq	<= tat77104g120190107