Lucene search

INCIBECVELIST:CVE-2020-8974

HistoryOct 17, 2022 - 9:16 p.m.

CVE-2020-8974 ZGR TPS200 NG Missing Reference to Active Allocated Resource

2022-10-1721:16:42

CWE-434

INCIBE

www.cve.org

zgr tps200 ng

firmware upload

vulnerability

web

malicious modifications

device unusable

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.001

Percentile

39.1%

JSON

In ZGR TPS200 NG 2.00 firmware version and 1.01 hardware version, the firmware upload process does not perform any type of restriction. This allows an attacker to modify it and re-upload it via web with malicious modifications, rendering the device unusable.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "ZGR TPS200 NG",
    "vendor": "ZGR",
    "versions": [
      {
        "status": "affected",
        "version": "2.00 firmware version 2.00"
      },
      {
        "status": "affected",
        "version": "1.01 hardware version 1.01"
      }
    ]
  }
]

References

www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-zgr-tps200-ng

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.001

Percentile

39.1%

JSON

Related for CVELIST:CVE-2020-8974