Sign-up

ID

VAR-202011-0083


CVE

CVE-2020-13536


TITLE

Moxa MXView  Privilege management vulnerability in series

Trust: 0.8

sources: JVNDB: JVNDB-2020-013095

DESCRIPTION

An exploitable local privilege elevation vulnerability exists in the file system permissions of Moxa MXView series 3.1.8 installation. Depending on the vector chosen, an attacker can either add code to a script or replace a binary. By default MXViewService, which starts as a NT SYSTEM authority user executes a series of Node.Js scripts to start additional application functionality. Moxa MXView There is a permission management vulnerability in the series.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. Moxa MXView is a software dedicated to network management developed by Moxa Corporation in Taiwan, China. This software can be used to configure and process all devices in the network

Trust: 1.71

sources: NVD: CVE-2020-13536 // JVNDB: JVNDB-2020-013095 // VULHUB: VHN-166324

AFFECTED PRODUCTS

vendor:moxamodel:mxviewscope:eqversion:3.1.8

Trust: 1.8

vendor:moxamodel:mxviewscope:eqversion: -

Trust: 0.8

sources: JVNDB: JVNDB-2020-013095 // NVD: CVE-2020-13536

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-13536
value: HIGH

Trust: 1.0

talos-cna@cisco.com: CVE-2020-13536
value: CRITICAL

Trust: 1.0

NVD: CVE-2020-13536
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202011-338
value: HIGH

Trust: 0.6

VULHUB: VHN-166324
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2020-13536
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-166324
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2020-13536
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

talos-cna@cisco.com: CVE-2020-13536
baseSeverity: CRITICAL
baseScore: 9.3
vectorString: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.5
impactScore: 6.0
version: 3.0

Trust: 1.0

NVD: CVE-2020-13536
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-166324 // JVNDB: JVNDB-2020-013095 // CNNVD: CNNVD-202011-338 // NVD: CVE-2020-13536 // NVD: CVE-2020-13536

PROBLEMTYPE DATA

problemtype:CWE-276

Trust: 1.1

problemtype:Improper authority management (CWE-269) [NVD Evaluation ]

Trust: 0.8

problemtype:CWE-269

Trust: 0.1

sources: VULHUB: VHN-166324 // JVNDB: JVNDB-2020-013095 // NVD: CVE-2020-13536

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202011-338

TYPE

authorization issue

Trust: 0.6

sources: CNNVD: CNNVD-202011-338

PATCH

title:MXview Seriesurl:https://www.moxa.com/en/support/product-support/software-and-documentation/search?psid=53389

Trust: 0.8

title:Moxa MXView Remediation measures for authorization problem vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=134023

Trust: 0.6

sources: JVNDB: JVNDB-2020-013095 // CNNVD: CNNVD-202011-338

EXTERNAL IDS

db:NVDid:CVE-2020-13536

Trust: 2.5

db:TALOSid:TALOS-2020-1148

Trust: 2.5

db:JVNDBid:JVNDB-2020-013095

Trust: 0.8

db:CNNVDid:CNNVD-202011-338

Trust: 0.7

db:CNVDid:CNVD-2020-63631

Trust: 0.1

db:VULHUBid:VHN-166324

Trust: 0.1

sources: VULHUB: VHN-166324 // JVNDB: JVNDB-2020-013095 // CNNVD: CNNVD-202011-338 // NVD: CVE-2020-13536

REFERENCES

url:https://talosintelligence.com/vulnerability_reports/talos-2020-1148

Trust: 2.5

url:https://nvd.nist.gov/vuln/detail/cve-2020-13536

Trust: 1.4

sources: VULHUB: VHN-166324 // JVNDB: JVNDB-2020-013095 // CNNVD: CNNVD-202011-338 // NVD: CVE-2020-13536

CREDITS

Discovered by Yuri Kramarz of Cisco Talos.

Trust: 0.6

sources: CNNVD: CNNVD-202011-338

SOURCES

db:VULHUBid:VHN-166324
db:JVNDBid:JVNDB-2020-013095
db:CNNVDid:CNNVD-202011-338
db:NVDid:CVE-2020-13536

LAST UPDATE DATE

2024-11-23T22:05:24.024000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-166324date:2022-06-07T00:00:00
db:JVNDBid:JVNDB-2020-013095date:2021-06-18T05:33:00
db:CNNVDid:CNNVD-202011-338date:2022-04-20T00:00:00
db:NVDid:CVE-2020-13536date:2024-11-21T05:01:27.027

SOURCES RELEASE DATE

db:VULHUBid:VHN-166324date:2020-11-05T00:00:00
db:JVNDBid:JVNDB-2020-013095date:2021-06-18T00:00:00
db:CNNVDid:CNNVD-202011-338date:2020-11-04T00:00:00
db:NVDid:CVE-2020-13536date:2020-11-05T21:15:12.377