Lucene search

TalosCVE-2020-13528

HistoryDec 18, 2020 - 12:15 a.m.

CVE-2020-13528

2020-12-1800:15:14

CWE-319

talos

web.nvd.nist.gov

cve-2020-13528

information disclosure

vulnerability

lantronix xport edge

http request

network sniffing

CVSS2

2.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:H/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

AI Score

4.9

Confidence

High

EPSS

0.004

Percentile

73.3%

JSON

An information disclosure vulnerability exists in the Web Manager and telnet CLI functionality of Lantronix XPort EDGE 3.0.0.0R11, 3.1.0.0R9, 3.4.0.0R12 and 4.2.0.0R7. A specially crafted HTTP request can cause information disclosure. An attacker can sniff the network to trigger this vulnerability.

Affected configurations

Nvd

Vulners

Node

lantronixxport_edge_firmwareMatch3.0.0.0r11

lantronixxport_edge_firmwareMatch3.1.0.0r9

lantronixxport_edge_firmwareMatch3.4.0.0r12

lantronixxport_edge_firmwareMatch4.2.0.0r7

AND

lantronixxport_edgeMatch-

VendorProductVersionCPE
lantronixxport_edge_firmware3.0.0.0cpe:2.3:o:lantronix:xport_edge_firmware:3.0.0.0:r11:*:*:*:*:*:*
lantronixxport_edge_firmware3.1.0.0cpe:2.3:o:lantronix:xport_edge_firmware:3.1.0.0:r9:*:*:*:*:*:*
lantronixxport_edge_firmware3.4.0.0cpe:2.3:o:lantronix:xport_edge_firmware:3.4.0.0:r12:*:*:*:*:*:*
lantronixxport_edge_firmware4.2.0.0cpe:2.3:o:lantronix:xport_edge_firmware:4.2.0.0:r7:*:*:*:*:*:*
lantronixxport_edge-cpe:2.3:h:lantronix:xport_edge:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
lantronix	xport_edge_firmware	3.0.0.0	cpe:2.3:o:lantronix:xport_edge_firmware:3.0.0.0:r11::::::
lantronix	xport_edge_firmware	3.1.0.0	cpe:2.3:o:lantronix:xport_edge_firmware:3.1.0.0:r9::::::
lantronix	xport_edge_firmware	3.4.0.0	cpe:2.3:o:lantronix:xport_edge_firmware:3.4.0.0:r12::::::
lantronix	xport_edge_firmware	4.2.0.0	cpe:2.3:o:lantronix:xport_edge_firmware:4.2.0.0:r7::::::
lantronix	xport_edge	-	cpe:2.3:h:lantronix:xport_edge:-:::::::*

CNA Affected

[
  {
    "product": "Lantronix",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Lantronix XPort EDGE 3.0.0.0R11 Lantronix XPort EDGE 3.1.0.0R9 Lantronix XPort EDGE 3.4.0.0R12Lantronix XPort EDGE 4.2.0.0R7"
      }
    ]
  }
]

References

talosintelligence.com/vulnerability_reports/TALOS-2020-1136

Social References

CVSS2

2.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:H/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

AI Score

4.9

Confidence

High

EPSS

0.004

Percentile

73.3%

JSON

Related for CVE-2020-13528