CVE-2020-23161

CVE-2020-23161 describes a local file inclusion in Pyrescom Termod4 time management devices prior to 10.04k. The issue allows an authenticated remote attacker to traverse the device’s filesystem and read sensitive files by tampering with the file-path parameter in the Maintenance > Logs URL. T...

CVE-2020-23160

CVE-2020-23160 affects Pyrescom Termod4 time management devices prior to firmware 10.04k. The issue permits authenticated remote attackers to execute arbitrary commands as root on the device. A Proof-of-Concept exploit exists for PoC usage, highlighting web server component vulnerabilities that c...

CVE-2020-23160

Remote code execution in Pyrescom Termod4 time management devices before 10.04k allows authenticated remote attackers to arbitrary commands as root on the devices...

CVE-2020-23161: Improper Limitation of a Pathname to a Restricted Directory

Local file inclusion in Pyrescom Termod4 time management devices before 10.04k allows authenticated remote attackers to traverse directories and read sensitive files via the Maintenance Logs menu and manipulating the file-path in the URL...

CVE-2020-23162: Use of a Broken or Risky Cryptographic Algorithm

Sensitive information disclosure and weak encryption in Pyrescom Termod4 time management devices before 10.04k allows remote attackers to read a session-file and obtain plain-text user credentials...

PT-2021-10848

Name of the Vulnerable Software and Affected Versions Pyrescom Termod4 versions prior to 10.04k Description The issue concerns sensitive information disclosure and weak encryption, allowing remote attackers to read a session-file and obtain plain-text user credentials. Recommendations For version...

PT-2021-10846

Name of the Vulnerable Software and Affected Versions Pyrescom Termod4 versions prior to 10.04k Description The issue allows authenticated remote attackers to execute arbitrary commands as root on the devices, which can lead to remote code execution. Recommendations For versions prior to 10.04k,...

CVE-2020-23160: Undefined Security Weakness

Remote code execution in Pyrescom Termod4 time management devices before 10.04k allows authenticated remote attackers to arbitrary commands as root on the devices...

PT-2021-10847

Name of the Vulnerable Software and Affected Versions Pyrescom Termod4 versions prior to 10.04k Description The issue allows authenticated remote attackers to traverse directories and read sensitive files. This is achieved by manipulating the file-path in the URL via the Maintenance Logs menu...