Sign-up

ID

VAR-202109-0005


CVE

CVE-2020-12030


TITLE

Emerson WirelessHART Gateway Improper access control vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2020-004483

DESCRIPTION

There is a flaw in the code used to configure the internal gateway firewall when the gateway's VLAN feature is enabled. If a user enables the VLAN setting, the internal gateway firewall becomes disabled resulting in exposure of all ports used by the gateway. Emerson Provides Emerson WirelessHART Gateway Contains improper access control vulnerabilities. Emerson WirelessHART Gateway Is Emerson It is an industrial wireless gateway device provided by

Trust: 2.25

sources: NVD: CVE-2020-12030 // JVNDB: JVNDB-2020-004483 // CNVD: CNVD-2020-36949 // VULMON: CVE-2020-12030

IOT TAXONOMY

category:['ICS', 'Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2020-36949

AFFECTED PRODUCTS

vendor:emersonmodel:wireless 1552wu gatewayscope:gteversion:4.6.43

Trust: 1.0

vendor:emersonmodel:wireless 1420 gatewayscope:gteversion:4.6.43

Trust: 1.0

vendor:emersonmodel:wireless 1420 gatewayscope:lteversion:4.7.84

Trust: 1.0

vendor:emersonmodel:wireless 1552wu gatewayscope:lteversion:4.7.84

Trust: 1.0

vendor:emersonmodel:wireless 1410 gatewayscope:lteversion:4.7.84

Trust: 1.0

vendor:emersonmodel:wireless 1410 gatewayscope:gteversion:4.6.43

Trust: 1.0

vendor:emersonmodel:wireless 1410 gatewayscope:eqversion:revision 4.6.43 から 4.7.84

Trust: 0.8

vendor:emersonmodel:wireless 1420 gatewayscope:eqversion:revision 4.6.43 から 4.7.84

Trust: 0.8

vendor:emersonmodel:wireless 1552wu gatewayscope:eqversion:4.6.43 から 4.7.84

Trust: 0.8

vendor:emersonmodel:electric wireless gatewayscope:eqversion:1410>=4.6.43,<=4.7.84

Trust: 0.6

vendor:emersonmodel:electric wireless gatewayscope:eqversion:1420>=4.6.43,<=4.7.84

Trust: 0.6

vendor:emersonmodel:electric wireless 1552wu gatewayscope:gteversion:4.6.43,<=4.7.84

Trust: 0.6

sources: CNVD: CNVD-2020-36949 // JVNDB: JVNDB-2020-004483 // NVD: CVE-2020-12030

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-12030
value: CRITICAL

Trust: 1.0

ics-cert@hq.dhs.gov: CVE-2020-12030
value: CRITICAL

Trust: 1.0

IPA: JVNDB-2020-004483
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2020-36949
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202005-800
value: CRITICAL

Trust: 0.6

VULMON: CVE-2020-12030
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2020-12030
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

CNVD: CNVD-2020-36949
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2020-12030
baseSeverity: CRITICAL
baseScore: 10.0
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 6.0
version: 3.1

Trust: 2.0

IPA score: JVNDB-2020-004483
baseSeverity: CRITICAL
baseScore: 10
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2020-36949 // VULMON: CVE-2020-12030 // JVNDB: JVNDB-2020-004483 // CNNVD: CNNVD-202005-800 // NVD: CVE-2020-12030 // NVD: CVE-2020-12030

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

problemtype:CWE-284

Trust: 1.0

sources: NVD: CVE-2020-12030

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202005-800

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202005-800

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2020-004483

PATCH
title:emerson Wireless 1410 Gatewayurl:https://www.emerson.com/en-br/catalog/emerson-sku-1410-wireless-gateway
Trust: 0.8
title:Patch for Multiple Emerson Electric products access control error vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/225029
Trust: 0.6
title:Multiple Emerson Electric Product access control error vulnerability fixesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=118753
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2020-36949 // 
            
            
            
            JVNDB: JVNDB-2020-004483 // 
            
            
            
            CNNVD: CNNVD-202005-800

EXTERNAL IDS
db:ICS CERTid:ICSA-20-135-02
Trust: 3.1
db:NVDid:CVE-2020-12030
Trust: 3.1
db:JVNid:JVNVU94025006
Trust: 0.8
db:JVNDBid:JVNDB-2020-004483
Trust: 0.8
db:CNVDid:CNVD-2020-36949
Trust: 0.6
db:CNNVDid:CNNVD-202005-800
Trust: 0.6
db:VULMONid:CVE-2020-12030
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2020-36949 // 
            
            
            
            VULMON: CVE-2020-12030 // 
            
            
            
            JVNDB: JVNDB-2020-004483 // 
            
            
            
            CNNVD: CNNVD-202005-800 // 
            
            
            
            NVD: CVE-2020-12030

REFERENCES
url:https://www.us-cert.gov/ics/advisories/icsa-20-135-02
Trust: 2.0
url:https://us-cert.cisa.gov/ics/advisories/icsa-20-135-02
Trust: 1.7
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-12030
Trust: 0.8
url:http://jvn.jp/cert/jvnvu94025006
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2020-12030
Trust: 0.6
url:https://cwe.mitre.org/data/definitions/.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2020-36949 // 
            
            
            
            VULMON: CVE-2020-12030 // 
            
            
            
            JVNDB: JVNDB-2020-004483 // 
            
            
            
            CNNVD: CNNVD-202005-800 // 
            
            
            
            NVD: CVE-2020-12030

SOURCES
db:CNVDid:CNVD-2020-36949
db:VULMONid:CVE-2020-12030
db:JVNDBid:JVNDB-2020-004483
db:CNNVDid:CNNVD-202005-800
db:NVDid:CVE-2020-12030

LAST UPDATE DATE
2024-08-14T15:42:45.873000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2020-36949date:2020-07-09T00:00:00
db:VULMONid:CVE-2020-12030date:2022-07-08T00:00:00
db:JVNDBid:JVNDB-2020-004483date:2020-05-18T00:00:00
db:CNNVDid:CNNVD-202005-800date:2022-07-11T00:00:00
db:NVDid:CVE-2020-12030date:2022-07-08T18:20:47.457

SOURCES RELEASE DATE
db:CNVDid:CNVD-2020-36949date:2020-07-09T00:00:00
db:VULMONid:CVE-2020-12030date:2021-09-29T00:00:00
db:JVNDBid:JVNDB-2020-004483date:2020-05-18T00:00:00
db:CNNVDid:CNNVD-202005-800date:2020-05-14T00:00:00
db:NVDid:CVE-2020-12030date:2021-09-29T20:15:07.870