Details of VAR-202001-1817

ID

VAR-202001-1817

CVE

CVE-2020-6170

TITLE

Genexis Platinum-4410 Authentication vulnerabilities in devices

Trust: 0.8

sources: JVNDB: JVNDB-2020-001334

DESCRIPTION

An authentication bypass vulnerability on Genexis Platinum-4410 v2.1 P4410-V2 1.28 devices allows attackers to obtain cleartext credentials from the HTML source code of the cgi-bin/index2.asp URI. Genexis Platinum-4410 The device contains an authentication vulnerability.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. Genexis Platinum-4410 is a WiFi 300/750 Mbps three-network integrated GPON ONT series router. Genexis Platinum-4410 2.1 P4410-V2 1.28 has an authentication bypass vulnerability

Trust: 2.16

sources: NVD: CVE-2020-6170 // JVNDB: JVNDB-2020-001334 // CNVD: CNVD-2020-14704

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2020-14704

AFFECTED PRODUCTS

vendor:	genexis	model:	platinum-4410	scope:	eq	version:	1.28	Trust: 1.0
vendor:	genexis	model:	platinum-4410	scope:	eq	version:	2 1.28	Trust: 0.8
vendor:	genexis	model:	platinum-4410 p4410-v2	scope:	eq	version:	2.11.28	Trust: 0.6

sources: CNVD: CNVD-2020-14704 // JVNDB: JVNDB-2020-001334 // NVD: CVE-2020-6170

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD:	CVE-2020-6170
value:	CRITICAL
Trust: 1.8
CNVD:	CNVD-2020-14704
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-202001-245
value:	CRITICAL
Trust: 0.6

NVD:
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	FALSE
obtainAllPrivilege:	FALSE
obtainUserPrivilege:	FALSE
obtainOtherPrivilege:	FALSE
userInteractionRequired:	FALSE
version:	2.0
Trust: 1.0
NVD:	CVE-2020-6170
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
CNVD:	CNVD-2020-14704
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

NVD:
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2020-6170
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2020-14704 // JVNDB: JVNDB-2020-001334 // NVD: CVE-2020-6170 // CNNVD: CNNVD-202001-245

PROBLEMTYPE DATA

problemtype:	CWE-200	Trust: 1.0
problemtype:	CWE-306	Trust: 1.0
problemtype:	CWE-287	Trust: 0.8

sources: JVNDB: JVNDB-2020-001334 // NVD: CVE-2020-6170

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202001-245

TYPE

access control error

Trust: 0.6

sources: CNNVD: CNNVD-202001-245

CONFIGURATIONS

sources: NVD: CVE-2020-6170

PATCH

title:

Top Page

url:

https://genexis.co.in/

Trust: 0.8

sources: JVNDB: JVNDB-2020-001334

EXTERNAL IDS

db:	NVD	id:	CVE-2020-6170	Trust: 3.0
db:	PACKETSTORM	id:	156075	Trust: 2.4
db:	JVNDB	id:	JVNDB-2020-001334	Trust: 0.8
db:	CNVD	id:	CNVD-2020-14704	Trust: 0.6
db:	EXPLOIT-DB	id:	47961	Trust: 0.6
db:	CNNVD	id:	CNNVD-202001-245	Trust: 0.6

sources: CNVD: CNVD-2020-14704 // JVNDB: JVNDB-2020-001334 // NVD: CVE-2020-6170 // CNNVD: CNNVD-202001-245

REFERENCES

url:	http://packetstormsecurity.com/files/156075/genexis-platinum-4410-2.1-authentication-bypass.html	Trust: 2.4
url:	https://nvd.nist.gov/vuln/detail/cve-2020-6170	Trust: 2.0
url:	https://medium.com/%40husinulzsanub/exploiting-router-authentication-through-web-interface-68660c708206	Trust: 1.0
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-6170	Trust: 0.8
url:	https://medium.com/@husinulzsanub/exploiting-router-authentication-through-web-interface-68660c708206	Trust: 0.6
url:	https://www.exploit-db.com/exploits/47961	Trust: 0.6

sources: CNVD: CNVD-2020-14704 // JVNDB: JVNDB-2020-001334 // NVD: CVE-2020-6170 // CNNVD: CNNVD-202001-245

CREDITS

Husinul Sanub

Trust: 0.6

sources: CNNVD: CNNVD-202001-245

SOURCES

db:	CNVD	id:	CNVD-2020-14704
db:	JVNDB	id:	JVNDB-2020-001334
db:	NVD	id:	CVE-2020-6170
db:	CNNVD	id:	CNNVD-202001-245

LAST UPDATE DATE

2023-12-18T13:37:57.802000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2020-14704	date:	2020-02-29T00:00:00
db:	JVNDB	id:	JVNDB-2020-001334	date:	2020-01-31T00:00:00
db:	NVD	id:	CVE-2020-6170	date:	2023-11-07T03:24:13.047
db:	CNNVD	id:	CNNVD-202001-245	date:	2022-01-04T00:00:00

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2020-14704	date:	2020-02-29T00:00:00
db:	JVNDB	id:	JVNDB-2020-001334	date:	2020-01-31T00:00:00
db:	NVD	id:	CVE-2020-6170	date:	2020-01-08T06:15:12.383
db:	CNNVD	id:	CNNVD-202001-245	date:	2020-01-08T00:00:00