Sign-up

ID

VAR-202102-0539


CVE

CVE-2020-9306


TITLE

Tesla SolarCity Solar Monitoring Gateway  Vulnerability in Using Hard Coded Credentials

Trust: 0.8

sources: JVNDB: JVNDB-2020-011301

DESCRIPTION

Tesla SolarCity Solar Monitoring Gateway through 5.46.43 has a "Use of Hard-coded Credentials" issue because Digi ConnectPort X2e uses a .pyc file to store the cleartext password for the python user account. There is a security vulnerability in Tesla SolarCity Solar Monitoring Gateway. There is no information about this vulnerability at present. Please keep an eye on CNNVD or manufacturer announcements

Trust: 1.71

sources: NVD: CVE-2020-9306 // JVNDB: JVNDB-2020-011301 // VULHUB: VHN-187431

AFFECTED PRODUCTS

vendor:teslamodel:solarcity solar monitoring gatewayscope:lteversion:5.46.43

Trust: 1.0

vendor:teslamodel:solarcity solar monitoring ゲートウェイscope:eqversion: -

Trust: 0.8

vendor:teslamodel:solarcity solar monitoring ゲートウェイscope:lteversion:solarcity solar monitoring gateway 5.46.43 until

Trust: 0.8

sources: JVNDB: JVNDB-2020-011301 // NVD: CVE-2020-9306

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-9306
value: HIGH

Trust: 1.0

cve@mitre.org: CVE-2020-9306
value: HIGH

Trust: 1.0

NVD: CVE-2020-9306
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202102-1308
value: HIGH

Trust: 0.6

VULHUB: VHN-187431
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2020-9306
severity: MEDIUM
baseScore: 5.8
vectorString: AV:A/AC:L/AU:N/C:P/I:P/A:P
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 6.5
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-187431
severity: MEDIUM
baseScore: 5.8
vectorString: AV:A/AC:L/AU:N/C:P/I:P/A:P
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 6.5
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2020-9306
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 2.0

NVD: CVE-2020-9306
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-187431 // JVNDB: JVNDB-2020-011301 // CNNVD: CNNVD-202102-1308 // NVD: CVE-2020-9306 // NVD: CVE-2020-9306

PROBLEMTYPE DATA

problemtype:CWE-522

Trust: 1.1

problemtype:CWE-798

Trust: 1.1

problemtype:Using hardcoded credentials (CWE-798) [NVD Evaluation ]

Trust: 0.8

sources: VULHUB: VHN-187431 // JVNDB: JVNDB-2020-011301 // NVD: CVE-2020-9306

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-202102-1308

TYPE

trust management problem

Trust: 0.6

sources: CNNVD: CNNVD-202102-1308

PATCH

title:top pageurl:https://www.tesla.com/ja_jp

Trust: 0.8

sources: JVNDB: JVNDB-2020-011301

EXTERNAL IDS

db:NVDid:CVE-2020-9306

Trust: 2.5

db:JVNDBid:JVNDB-2020-011301

Trust: 0.8

db:CNNVDid:CNNVD-202102-1308

Trust: 0.7

db:VULHUBid:VHN-187431

Trust: 0.1

sources: VULHUB: VHN-187431 // JVNDB: JVNDB-2020-011301 // CNNVD: CNNVD-202102-1308 // NVD: CVE-2020-9306

REFERENCES

url:https://github.com/fireeye/vulnerability-disclosures/blob/master/feye-2020-0019/feye-2020-0019.md

Trust: 2.5

url:https://www.fireeye.com/blog/threat-research.html

Trust: 1.7

url:https://www.fireeye.com/blog/threat-research/2021/02/solarcity-exploitation-of-x2e-iot-device-part-one.html

Trust: 1.7

url:https://www.fireeye.com/blog/threat-research/2021/02/solarcity-exploitation-of-x2e-iot-device-part-two.html

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2020-9306

Trust: 1.4

sources: VULHUB: VHN-187431 // JVNDB: JVNDB-2020-011301 // CNNVD: CNNVD-202102-1308 // NVD: CVE-2020-9306

SOURCES

db:VULHUBid:VHN-187431
db:JVNDBid:JVNDB-2020-011301
db:CNNVDid:CNNVD-202102-1308
db:NVDid:CVE-2020-9306

LAST UPDATE DATE

2024-11-23T21:51:02.988000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-187431date:2021-07-21T00:00:00
db:JVNDBid:JVNDB-2020-011301date:2021-03-26T06:45:00
db:CNNVDid:CNNVD-202102-1308date:2021-08-16T00:00:00
db:NVDid:CVE-2020-9306date:2024-11-21T05:40:23.083

SOURCES RELEASE DATE

db:VULHUBid:VHN-187431date:2021-02-18T00:00:00
db:JVNDBid:JVNDB-2020-011301date:2021-03-26T00:00:00
db:CNNVDid:CNNVD-202102-1308date:2021-02-17T00:00:00
db:NVDid:CVE-2020-9306date:2021-02-18T00:15:17.327