Lucene search

PRIOn knowledge basePRION:CVE-2020-21999

HistoryMay 04, 2021 - 4:15 p.m.

Command injection

2021-05-0416:15:00

PRIOn knowledge base

www.prio-n.com

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

9.1 High

AI Score

Confidence

High

9 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

0.042 Low

EPSS

Percentile

92.0%

JSON

iWT Ltd FaceSentry Access Control System 6.4.8 suffers from an authenticated OS command injection vulnerability using default credentials. This can be exploited to inject and execute arbitrary shell commands as the root user via the ‘strInIP’ POST parameter in pingTest PHP script.

CPENameOperatorVersion
facesentry_access_control_system_firmwareeq5.7.0
facesentry_access_control_system_firmwareeq5.7.2
facesentry_access_control_system_firmwareeq6.4.8

Name	Operator	Version
facesentry_access_control_system_firmware	eq	5.7.0
facesentry_access_control_system_firmware	eq	5.7.2
facesentry_access_control_system_firmware	eq	6.4.8

References

www.exploit-db.com/exploits/47066

www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5525.php

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

9.1 High

AI Score

Confidence

High

9 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

0.042 Low

EPSS

Percentile

92.0%

JSON

Related for PRION:CVE-2020-21999