Lucene search

MitreCVE-2020-24055

HistoryAug 21, 2020 - 3:15 p.m.

CVE-2020-24055

2020-08-2115:15:13

CWE-787

mitre

web.nvd.nist.gov

cve-2020-24055

verint

5620ptz

4320

autodiscovery

stack buffer overflow

tcp 6666

nvd

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.004

Percentile

75.0%

JSON

Verint 5620PTZ Verint_FW_0_42 and Verint 4320 V4320_FW_0_23, and V4320_FW_0_31 units feature an autodiscovery service implemented in the binary executable ‘/usr/sbin/DM’ that listens on port TCP 6666. The service is vulnerable to a stack buffer overflow. It is worth noting that this service does not require any authentication.

Affected configurations

Nvd

Node

verint5620ptz_firmwareMatchverint_fw_0_42

AND

verint5620ptzMatch-

Node

verint4320_firmwareMatchv4320_fw_0_23

verint4320_firmwareMatchv4320_fw_0_31

AND

verint4320Match-

VendorProductVersionCPE
verint5620ptz_firmwareverint_fw_0_42cpe:2.3:o:verint:5620ptz_firmware:verint_fw_0_42:*:*:*:*:*:*:*
verint5620ptz-cpe:2.3:h:verint:5620ptz:-:*:*:*:*:*:*:*
verint4320_firmwarev4320_fw_0_23cpe:2.3:o:verint:4320_firmware:v4320_fw_0_23:*:*:*:*:*:*:*
verint4320_firmwarev4320_fw_0_31cpe:2.3:o:verint:4320_firmware:v4320_fw_0_31:*:*:*:*:*:*:*
verint4320-cpe:2.3:h:verint:4320:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
verint	5620ptz_firmware	verint_fw_0_42	cpe:2.3:o:verint:5620ptz_firmware:verint_fw_0_42:::::::*
verint	5620ptz	-	cpe:2.3:h:verint:5620ptz:-:::::::*
verint	4320_firmware	v4320_fw_0_23	cpe:2.3:o:verint:4320_firmware:v4320_fw_0_23:::::::*
verint	4320_firmware	v4320_fw_0_31	cpe:2.3:o:verint:4320_firmware:v4320_fw_0_31:::::::*
verint	4320	-	cpe:2.3:h:verint:4320:-:::::::*

References

ioac.tv/2Nbc40h

ioactive.com/verint-ptz-cameras-multiple-vulnerabilities/

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.004

Percentile

75.0%

JSON

Related for CVE-2020-24055