Sign-up

ID

VAR-202011-0084


CVE

CVE-2020-13537


TITLE

Moxa MXView  Privilege management vulnerability in series

Trust: 0.8

sources: JVNDB: JVNDB-2020-013094

DESCRIPTION

An exploitable local privilege elevation vulnerability exists in the file system permissions of Moxa MXView series 3.1.8 installation. Depending on the vector chosen, an attacker can either add code to a script or replace a binary.By default MXViewService, which starts as a NT SYSTEM authority user executes a series of Node.Js scripts to start additional application functionality and among them the mosquitto executable is also run. Moxa MXView There is a permission management vulnerability in the series.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. Moxa MXView is a software dedicated to network management developed by Moxa Corporation in Taiwan, China. This software can be used to configure and process all devices in the network

Trust: 1.71

sources: NVD: CVE-2020-13537 // JVNDB: JVNDB-2020-013094 // VULHUB: VHN-166325

AFFECTED PRODUCTS

vendor:moxamodel:mxviewscope:eqversion:3.1.8

Trust: 1.8

vendor:moxamodel:mxviewscope:eqversion: -

Trust: 0.8

sources: JVNDB: JVNDB-2020-013094 // NVD: CVE-2020-13537

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-13537
value: HIGH

Trust: 1.0

talos-cna@cisco.com: CVE-2020-13537
value: CRITICAL

Trust: 1.0

NVD: CVE-2020-13537
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202011-335
value: HIGH

Trust: 0.6

VULHUB: VHN-166325
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2020-13537
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-166325
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2020-13537
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

talos-cna@cisco.com: CVE-2020-13537
baseSeverity: CRITICAL
baseScore: 9.3
vectorString: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.5
impactScore: 6.0
version: 3.0

Trust: 1.0

NVD: CVE-2020-13537
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-166325 // JVNDB: JVNDB-2020-013094 // CNNVD: CNNVD-202011-335 // NVD: CVE-2020-13537 // NVD: CVE-2020-13537

PROBLEMTYPE DATA

problemtype:CWE-276

Trust: 1.1

problemtype:Improper authority management (CWE-269) [NVD Evaluation ]

Trust: 0.8

problemtype:CWE-269

Trust: 0.1

sources: VULHUB: VHN-166325 // JVNDB: JVNDB-2020-013094 // NVD: CVE-2020-13537

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202011-335

TYPE

authorization issue

Trust: 0.6

sources: CNNVD: CNNVD-202011-335

PATCH

title:MXview Seriesurl:https://www.moxa.com/en/support/product-support/software-and-documentation/search?psid=53389

Trust: 0.8

title:Moxa MXView Remediation measures for authorization problem vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=134022

Trust: 0.6

sources: JVNDB: JVNDB-2020-013094 // CNNVD: CNNVD-202011-335

EXTERNAL IDS

db:NVDid:CVE-2020-13537

Trust: 2.5

db:TALOSid:TALOS-2020-1148

Trust: 2.5

db:JVNDBid:JVNDB-2020-013094

Trust: 0.8

db:CNNVDid:CNNVD-202011-335

Trust: 0.7

db:CNVDid:CNVD-2020-63627

Trust: 0.1

db:VULHUBid:VHN-166325

Trust: 0.1

sources: VULHUB: VHN-166325 // JVNDB: JVNDB-2020-013094 // CNNVD: CNNVD-202011-335 // NVD: CVE-2020-13537

REFERENCES

url:https://talosintelligence.com/vulnerability_reports/talos-2020-1148

Trust: 2.5

url:https://nvd.nist.gov/vuln/detail/cve-2020-13537

Trust: 1.4

sources: VULHUB: VHN-166325 // JVNDB: JVNDB-2020-013094 // CNNVD: CNNVD-202011-335 // NVD: CVE-2020-13537

CREDITS

Discovered by Yuri Kramarz of Cisco Talos.

Trust: 0.6

sources: CNNVD: CNNVD-202011-335

SOURCES

db:VULHUBid:VHN-166325
db:JVNDBid:JVNDB-2020-013094
db:CNNVDid:CNNVD-202011-335
db:NVDid:CVE-2020-13537

LAST UPDATE DATE

2024-11-23T22:05:23.999000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-166325date:2022-06-07T00:00:00
db:JVNDBid:JVNDB-2020-013094date:2021-06-18T05:32:00
db:CNNVDid:CNNVD-202011-335date:2022-04-20T00:00:00
db:NVDid:CVE-2020-13537date:2024-11-21T05:01:27.153

SOURCES RELEASE DATE

db:VULHUBid:VHN-166325date:2020-11-05T00:00:00
db:JVNDBid:JVNDB-2020-013094date:2021-06-18T00:00:00
db:CNNVDid:CNNVD-202011-335date:2020-11-04T00:00:00
db:NVDid:CVE-2020-13537date:2020-11-05T21:15:12.457