Lucene search

[email protected]CVE-2020-12681

HistoryJul 26, 2021 - 12:15 p.m.

CVE-2020-12681

2021-07-2612:15:00

CWE-295

[email protected]

web.nvd.nist.gov

cve

2020

12681

tls certificate validation

3xlogic

infinias

eidc32

interception

control

door lock policies

nvd

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

7.4 High

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

34.6%

JSON

Missing TLS certificate validation on 3xLogic Infinias eIDC32 devices through 3.4.125 allows an attacker to intercept/control the channel by which door lock policies are applied.

CPENameOperatorVersion
3xlogic:infinias_eidc32_firmware3xlogic infinias eidc32 firmwarele3.4.125

CPE	Name	Operator	Version
3xlogic:infinias_eidc32_firmware	3xlogic infinias eidc32 firmware	le	3.4.125

References

www.3xlogic.com/products/access-control/infinias-ethernet-enabled-integrated-door-controller-eidc

www.3xlogic.com/sites/www.3xlogic.com/files/media/2020-08/INF_RN_infinias_eIDC32_V3.9_Firmware%20Release_08142020.pdf

Social References

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

7.4 High

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

34.6%

JSON

Related for CVE-2020-12681

prion1 cvelist1