Design/Logic Flaw

Iteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have world-writable permissions for the /root/cleardata.pl executed as root by crond and /root/loadperl.sh executed as root at boot time scripts...

CVE-2020-9020

The Iteris Vantage Velocity Field Unit (versions 2.3.1 , 2.4.2 , and 3.0 ) is susceptible to an OS command injection vulnerability. The root cause is the improper neutralization of shell metacharacters within the NTP Server field, which allows an attacker to inject and execute arbitrary OS comman...

CVE-2020-9020: Improper Neutralization of Special Elements used in an OS Command

Iteris Vantage Velocity Field Unit 2.3.1, 2.4.2, and 3.0 devices allow the injection of OS commands into cgi-bin/timeconfig.py via shell metacharacters in the NTP Server field...

CVE-2020-9023: Weak Password Requirements

Iteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have two users that are not documented and are configured with weak passwords User bluetooth, password bluetooth; User eclipse, password eclipse. Also, bluetooth is the root password...

PT-2020-20438

Name of the Vulnerable Software and Affected Versions Iteris Vantage Velocity Field Unit versions 2.3.1 through 2.4.2 Description The issue concerns undocumented users with weak passwords in the Iteris Vantage Velocity Field Unit. Specifically, there are two users: bluetooth with password...

PT-2020-20440

Name of the Vulnerable Software and Affected Versions Iteris Vantage Velocity Field Unit version 2.4.2 Description The issue concerns multiple stored XSS problems in all parameters of the Start Data Viewer feature, specifically within the /cgi-bin/loaddata.py script. Recommendations For Iteris...

PT-2020-20439

Name of the Vulnerable Software and Affected Versions Iteris Vantage Velocity Field Unit versions 2.3.1 through 2.4.2 Description The issue concerns world-writable permissions for certain scripts. Specifically, the /root/cleardata.pl script, which is executed as root by crond, and the...

CVE-2020-9024: Incorrect Permission Assignment for Critical Resource

Iteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have world-writable permissions for the /root/cleardata.pl executed as root by crond and /root/loadperl.sh executed as root at boot time scripts...

PT-2020-20435

Name of the Vulnerable Software and Affected Versions Iteris Vantage Velocity Field Unit versions 2.3.1, 2.4.2, and 3.0 Description The issue allows the injection of OS commands into "cgi-bin/timeconfig.py" via shell metacharacters in the NTP Server field. Recommendations For Iteris Vantage...

CVE-2020-9025: Improper Neutralization of Input During Web Page Generation

Iteris Vantage Velocity Field Unit 2.4.2 devices have multiple stored XSS issues in all parameters of the Start Data Viewer feature of the /cgi-bin/loaddata.py script...