Lucene search

JpcertCVE-2020-5685

HistoryJan 13, 2021 - 10:15 a.m.

CVE-2020-5685

2021-01-1310:15:15

CWE-78

jpcert

web.nvd.nist.gov

cve-2020-5685

univerge

sv9500

sv8500

os command execution

dos

crafted url

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.002

Percentile

64.8%

JSON

UNIVERGE SV9500 series from V1 to V7and SV8500 series from S6 to S8 allows an attacker to execute arbitrary OS commands or cause a denial-of-service (DoS) condition by sending a specially crafted request to a specific URL.

Affected configurations

Nvd

Node

necuniverge_sv9500_firmwareRangev1–v7

AND

necuniverge_sv9500Match-

Node

necuniverge_sv8500_firmwareRanges6–s8

AND

necuniverge_sv8500Match-

VendorProductVersionCPE
necuniverge_sv9500_firmware*cpe:2.3:o:nec:univerge_sv9500_firmware:*:*:*:*:*:*:*:*
necuniverge_sv9500-cpe:2.3:h:nec:univerge_sv9500:-:*:*:*:*:*:*:*
necuniverge_sv8500_firmware*cpe:2.3:o:nec:univerge_sv8500_firmware:*:*:*:*:*:*:*:*
necuniverge_sv8500-cpe:2.3:h:nec:univerge_sv8500:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
nec	univerge_sv9500_firmware	*	cpe:2.3:o:nec:univerge_sv9500_firmware::::::::
nec	univerge_sv9500	-	cpe:2.3:h:nec:univerge_sv9500:-:::::::*
nec	univerge_sv8500_firmware	*	cpe:2.3:o:nec:univerge_sv8500_firmware::::::::
nec	univerge_sv8500	-	cpe:2.3:h:nec:univerge_sv8500:-:::::::*

CNA Affected

[
  {
    "product": "UNIVERGE SV9500/SV8500 series",
    "vendor": "NEC Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "SV9500 series from V1 to V7and SV8500 series from S6 to S8"
      }
    ]
  }
]

References

jvn.jp/en/jp/JVN38784555/index.html

www.necplatforms.co.jp/en/press/security_adv.html

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.002

Percentile

64.8%

JSON

Related for CVE-2020-5685