Sign-up

ID

VAR-202010-0409


CVE

CVE-2020-17406


TITLE

Microhard Bullet-LTE  In  OS  Command injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2020-012542

DESCRIPTION

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microhard Bullet-LTE prior to v1.2.0-r1112. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of the ping parameter provided to tools.sh. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-10595. Microhard Bullet-LTE Has OS A command injection vulnerability exists. Zero Day Initiative To this vulnerability ZDI-CAN-10595 Was numbered.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state

Trust: 2.34

sources: NVD: CVE-2020-17406 // JVNDB: JVNDB-2020-012542 // ZDI: ZDI-20-1205 // VULMON: CVE-2020-17406

IOT TAXONOMY

category:['network device']sub_category:gateway

Trust: 0.1

category:['network device']sub_category:network device

Trust: 0.1

sources: OTHER: None

AFFECTED PRODUCTS

vendor:microhardcorpmodel:bullet-ltescope:ltversion:1.2.0-r1112

Trust: 1.0

vendor:microhardmodel:bulletltescope:eqversion: -

Trust: 0.8

vendor:microhardmodel:bulletltescope:ltversion:bulletlte firmware 1.2.0-r1112 less than

Trust: 0.8

vendor:microhardmodel:bullet-ltescope: - version: -

Trust: 0.7

sources: ZDI: ZDI-20-1205 // JVNDB: JVNDB-2020-012542 // NVD: CVE-2020-17406

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-17406
value: HIGH

Trust: 1.0

zdi-disclosures@trendmicro.com: CVE-2020-17406
value: HIGH

Trust: 1.0

NVD: CVE-2020-17406
value: HIGH

Trust: 0.8

ZDI: CVE-2020-17406
value: HIGH

Trust: 0.7

CNNVD: CNNVD-202010-579
value: HIGH

Trust: 0.6

VULMON: CVE-2020-17406
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2020-17406
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

zdi-disclosures@trendmicro.com: CVE-2020-17406
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.0

Trust: 1.8

nvd@nist.gov: CVE-2020-17406
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

ZDI: CVE-2020-17406
baseSeverity: HIGH
baseScore: 8.8
vectorString: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-20-1205 // VULMON: CVE-2020-17406 // JVNDB: JVNDB-2020-012542 // CNNVD: CNNVD-202010-579 // NVD: CVE-2020-17406 // NVD: CVE-2020-17406

PROBLEMTYPE DATA

problemtype:CWE-78

Trust: 1.0

problemtype:OS Command injection (CWE-78) [ Other ]

Trust: 0.8

sources: JVNDB: JVNDB-2020-012542 // NVD: CVE-2020-17406

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202010-579

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-202010-579

PATCH

title:Top Pageurl:http://www.microhardcorp.com/index.php

Trust: 0.8

sources: JVNDB: JVNDB-2020-012542

EXTERNAL IDS

db:NVDid:CVE-2020-17406

Trust: 3.3

db:ZDIid:ZDI-20-1205

Trust: 2.4

db:ZDIid:ZDI-20-1206

Trust: 0.8

db:JVNDBid:JVNDB-2020-012542

Trust: 0.8

db:ZDI_CANid:ZDI-CAN-10595

Trust: 0.7

db:CNNVDid:CNNVD-202010-579

Trust: 0.6

db:OTHERid:NONE

Trust: 0.1

db:VULMONid:CVE-2020-17406

Trust: 0.1

sources: OTHER: None // ZDI: ZDI-20-1205 // VULMON: CVE-2020-17406 // JVNDB: JVNDB-2020-012542 // CNNVD: CNNVD-202010-579 // NVD: CVE-2020-17406

REFERENCES

url:https://www.zerodayinitiative.com/advisories/zdi-20-1205/

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2020-17406

Trust: 1.4

url:https://www.zerodayinitiative.com/advisories/zdi-20-1206/

Trust: 0.8

url:https://ieeexplore.ieee.org/abstract/document/10769424

Trust: 0.1

url:https://cwe.mitre.org/data/definitions/78.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:https://exchange.xforce.ibmcloud.com/vulnerabilities/188449

Trust: 0.1

sources: OTHER: None // VULMON: CVE-2020-17406 // JVNDB: JVNDB-2020-012542 // CNNVD: CNNVD-202010-579 // NVD: CVE-2020-17406

CREDITS

Ricky "HeadlessZeke" Lawshae

Trust: 0.7

sources: ZDI: ZDI-20-1205

SOURCES

db:OTHERid: -
db:ZDIid:ZDI-20-1205
db:VULMONid:CVE-2020-17406
db:JVNDBid:JVNDB-2020-012542
db:CNNVDid:CNNVD-202010-579
db:NVDid:CVE-2020-17406

LAST UPDATE DATE

2025-01-30T21:28:02.649000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-20-1205date:2020-09-17T00:00:00
db:VULMONid:CVE-2020-17406date:2020-10-26T00:00:00
db:JVNDBid:JVNDB-2020-012542date:2021-05-12T07:02:00
db:CNNVDid:CNNVD-202010-579date:2020-10-27T00:00:00
db:NVDid:CVE-2020-17406date:2024-11-21T05:08:01.927

SOURCES RELEASE DATE

db:ZDIid:ZDI-20-1205date:2020-08-26T00:00:00
db:VULMONid:CVE-2020-17406date:2020-10-13T00:00:00
db:JVNDBid:JVNDB-2020-012542date:2021-05-12T00:00:00
db:CNNVDid:CNNVD-202010-579date:2020-10-13T00:00:00
db:NVDid:CVE-2020-17406date:2020-10-13T17:15:13.543