Lucene search

INCIBECVE-2020-8976

HistoryOct 17, 2022 - 10:15 p.m.

CVE-2020-8976

2022-10-1722:15:10

CWE-352

INCIBE

web.nvd.nist.gov

cve-2020-8976

zgr tps200 ng

integrated server

remote attacker

victim user

active session

malicious request

CVSS3

9.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

AI Score

8.6

Confidence

High

EPSS

0.001

Percentile

34.0%

JSON

The integrated server of the ZGR TPS200 NG on its 2.00 firmware version and 1.01 hardware version, allows a remote attacker to perform actions with the permissions of a victim user. For this to happen, the victim user has to have an active session and triggers the malicious request.

Affected configurations

Nvd

Vulners

Node

zigorzgr_tps200_ng_firmwareMatch2.00

AND

zigorzgr_tps200_ngMatch1.01

VendorProductVersionCPE
zigorzgr_tps200_ng_firmware2.00cpe:2.3:o:zigor:zgr_tps200_ng_firmware:2.00:*:*:*:*:*:*:*
zigorzgr_tps200_ng1.01cpe:2.3:h:zigor:zgr_tps200_ng:1.01:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
zigor	zgr_tps200_ng_firmware	2.00	cpe:2.3:o:zigor:zgr_tps200_ng_firmware:2.00:::::::*
zigor	zgr_tps200_ng	1.01	cpe:2.3:h:zigor:zgr_tps200_ng:1.01:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "ZGR TPS200 NG",
    "vendor": "ZGR",
    "versions": [
      {
        "status": "affected",
        "version": "2.00 firmware version 2.00"
      },
      {
        "status": "affected",
        "version": "1.01 hardware version 1.01"
      }
    ]
  }
]

References

www.incibe-cert.es/en/early-warning/ics-advisories/multiple-vulnerabilities-zgr-tps200-ng

Social References

CVSS3

9.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

AI Score

8.6

Confidence

High

EPSS

0.001

Percentile

34.0%

JSON

Related for CVE-2020-8976