Sign-up

ID

VAR-202002-1214


CVE

CVE-2020-6841


TITLE

D-Link DCH-M225 On the device OS Command injection vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2020-002177

DESCRIPTION

D-Link DCH-M225 1.05b01 and earlier devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the spotifyConnect.php userName parameter. D-Link DCH-M225 On the device OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. DCH-M225 is a Wifi portable audio extender. D-Link DCH-M225 1.05b01 and earlier versions have an arbitrary OS command execution vulnerability

Trust: 2.16

sources: NVD: CVE-2020-6841 // JVNDB: JVNDB-2020-002177 // CNVD: CNVD-2020-13159

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2020-13159

AFFECTED PRODUCTS

vendor:dlinkmodel:dch-m225scope:lteversion:1.05b01

Trust: 1.0

vendor:d linkmodel:dch-m225scope:eqversion:1.05b01

Trust: 0.8

vendor:d linkmodel:dch-m225 <=1.05b01scope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2020-13159 // JVNDB: JVNDB-2020-002177 // NVD: CVE-2020-6841

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-6841
value: CRITICAL

Trust: 1.0

NVD: JVNDB-2020-002177
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2020-13159
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202002-1064
value: CRITICAL

Trust: 0.6

nvd@nist.gov: CVE-2020-6841
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

NVD: JVNDB-2020-002177
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

CNVD: CNVD-2020-13159
severity: MEDIUM
baseScore: 6.0
vectorString: AV:N/AC:M/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 6.8
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2020-6841
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: JVNDB-2020-002177
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2020-13159 // JVNDB: JVNDB-2020-002177 // CNNVD: CNNVD-202002-1064 // NVD: CVE-2020-6841

PROBLEMTYPE DATA

problemtype:CWE-78

Trust: 1.8

sources: JVNDB: JVNDB-2020-002177 // NVD: CVE-2020-6841

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202002-1064

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-202002-1064

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2020-002177

PATCH
title:DCH-M225 :: Rev. Ax :: FW 1.05b01 and lower :: CVE-2020-6841 & CVE-2020-6841 :: Multiple Vulnerabilitiesurl:https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10152
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2020-002177

EXTERNAL IDS
db:NVDid:CVE-2020-6841
Trust: 3.0
db:DLINKid:SAP10152
Trust: 1.6
db:JVNDBid:JVNDB-2020-002177
Trust: 0.8
db:CNVDid:CNVD-2020-13159
Trust: 0.6
db:CNNVDid:CNNVD-202002-1064
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2020-13159 // 
            
            
            
            JVNDB: JVNDB-2020-002177 // 
            
            
            
            CNNVD: CNNVD-202002-1064 // 
            
            
            
            NVD: CVE-2020-6841

REFERENCES
url:https://gist.github.com/jezzaaa/38c752d0a129576b2cc523ce6325050f
Trust: 2.4
url:https://nvd.nist.gov/vuln/detail/cve-2020-6841
Trust: 2.0
url:https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=sap10152
Trust: 1.6
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-6841
Trust: 0.8
sources:
            
            
            CNVD: CNVD-2020-13159 // 
            
            
            
            JVNDB: JVNDB-2020-002177 // 
            
            
            
            CNNVD: CNNVD-202002-1064 // 
            
            
            
            NVD: CVE-2020-6841

SOURCES
db:CNVDid:CNVD-2020-13159
db:JVNDBid:JVNDB-2020-002177
db:CNNVDid:CNNVD-202002-1064
db:NVDid:CVE-2020-6841

LAST UPDATE DATE
2024-11-23T21:36:09.843000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2020-13159date:2020-02-24T00:00:00
db:JVNDBid:JVNDB-2020-002177date:2020-03-05T00:00:00
db:CNNVDid:CNNVD-202002-1064date:2023-04-27T00:00:00
db:NVDid:CVE-2020-6841date:2024-11-21T05:36:16.413

SOURCES RELEASE DATE
db:CNVDid:CNVD-2020-13159date:2020-02-24T00:00:00
db:JVNDBid:JVNDB-2020-002177date:2020-03-05T00:00:00
db:CNNVDid:CNNVD-202002-1064date:2020-02-21T00:00:00
db:NVDid:CVE-2020-6841date:2020-02-21T16:15:11.717