Lucene search

TalosCVE-2020-13527

HistoryDec 18, 2020 - 12:15 a.m.

CVE-2020-13527

2020-12-1800:15:14

CWE-352

talos

web.nvd.nist.gov

cve-2020-13527

authentication bypass

vulnerability

lantronix xport edge

http request

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

4.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N

AI Score

4.9

Confidence

High

EPSS

0.001

Percentile

23.4%

JSON

An authentication bypass vulnerability exists in the Web Manager functionality of Lantronix XPort EDGE 3.0.0.0R11, 3.1.0.0R9, 3.4.0.0R12 and 4.2.0.0R7. A specially crafted HTTP request can cause increased privileges. An attacker can send an HTTP request to trigger this vulnerability.

Affected configurations

Nvd

Vulners

Node

lantronixxport_edgeMatch-

AND

lantronixxport_edge_firmwareMatch3.0.0.0r11

lantronixxport_edge_firmwareMatch3.1.0.0r9

lantronixxport_edge_firmwareMatch3.4.0.0r12

lantronixxport_edge_firmwareMatch4.2.0.0r7

Node

lantronixsgxMatch-

AND

lantronixsgx_firmwareMatch8.7.0.0r1

lantronixsgx_firmwareMatch8.9.0.0r4

VendorProductVersionCPE
lantronixxport_edge-cpe:2.3:h:lantronix:xport_edge:-:*:*:*:*:*:*:*
lantronixxport_edge_firmware3.0.0.0cpe:2.3:o:lantronix:xport_edge_firmware:3.0.0.0:r11:*:*:*:*:*:*
lantronixxport_edge_firmware3.1.0.0cpe:2.3:o:lantronix:xport_edge_firmware:3.1.0.0:r9:*:*:*:*:*:*
lantronixxport_edge_firmware3.4.0.0cpe:2.3:o:lantronix:xport_edge_firmware:3.4.0.0:r12:*:*:*:*:*:*
lantronixxport_edge_firmware4.2.0.0cpe:2.3:o:lantronix:xport_edge_firmware:4.2.0.0:r7:*:*:*:*:*:*
lantronixsgx-cpe:2.3:h:lantronix:sgx:-:*:*:*:*:*:*:*
lantronixsgx_firmware8.7.0.0cpe:2.3:o:lantronix:sgx_firmware:8.7.0.0:r1:*:*:*:*:*:*
lantronixsgx_firmware8.9.0.0cpe:2.3:o:lantronix:sgx_firmware:8.9.0.0:r4:*:*:*:*:*:*

Vendor	Product	Version	CPE
lantronix	xport_edge	-	cpe:2.3:h:lantronix:xport_edge:-:::::::*
lantronix	xport_edge_firmware	3.0.0.0	cpe:2.3:o:lantronix:xport_edge_firmware:3.0.0.0:r11::::::
lantronix	xport_edge_firmware	3.1.0.0	cpe:2.3:o:lantronix:xport_edge_firmware:3.1.0.0:r9::::::
lantronix	xport_edge_firmware	3.4.0.0	cpe:2.3:o:lantronix:xport_edge_firmware:3.4.0.0:r12::::::
lantronix	xport_edge_firmware	4.2.0.0	cpe:2.3:o:lantronix:xport_edge_firmware:4.2.0.0:r7::::::
lantronix	sgx	-	cpe:2.3:h:lantronix:sgx:-:::::::*
lantronix	sgx_firmware	8.7.0.0	cpe:2.3:o:lantronix:sgx_firmware:8.7.0.0:r1::::::
lantronix	sgx_firmware	8.9.0.0	cpe:2.3:o:lantronix:sgx_firmware:8.9.0.0:r4::::::

CNA Affected

[
  {
    "product": "Lantronix",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Lantronix XPort EDGE 3.0.0.0R11 Lantronix XPort EDGE 3.1.0.0R9 Lantronix XPort EDGE 3.4.0.0R12 Lantronix XPort EDGE 4.2.0.0R7 Lantronix SGX 5150 8.7.0.0R1 Lantronix SGX 5150 8.9.0.0R4"
      }
    ]
  }
]

References

talosintelligence.com/vulnerability_reports/TALOS-2020-1135

Social References

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

4.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N

AI Score

4.9

Confidence

High

EPSS

0.001

Percentile

23.4%

JSON

Related for CVE-2020-13527