An unspecified vulnerability exists in the Iteris Vantage Velocity Field Unit.

The Iteris Vantage Velocity Field Unit is a road monitoring field unit from Iteris USA. A security vulnerability exists in the Iteris Vantage Velocity Field Unit version 2.3.1 and 2.4.2, which originates from a program that assigns global writable privileges to the /root/cleardata.pl and...

CVE-2020-9024

Iteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have world-writable permissions for the /root/cleardata.pl executed as root by crond and /root/loadperl.sh executed as root at boot time scripts...

Design/Logic Flaw

Iteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have world-writable permissions for the /root/cleardata.pl executed as root by crond and /root/loadperl.sh executed as root at boot time scripts...

CVE-2020-9020

The Iteris Vantage Velocity Field Unit (versions 2.3.1 , 2.4.2 , and 3.0 ) is susceptible to an OS command injection vulnerability. The root cause is the improper neutralization of shell metacharacters within the NTP Server field, which allows an attacker to inject and execute arbitrary OS comman...

CVE-2020-9025

CVE-2020-9025 affects Iteris Vantage Velocity Field Unit, version 2.4.2. The vulnerability is a class of stored XSS occurring in all parameters of the Start Data Viewer feature implemented by the /cgi-bin/loaddata.py script. The root cause is stated as a lack of proper validation of client-side d...

CVE-2020-9020: Improper Neutralization of Special Elements used in an OS Command

Iteris Vantage Velocity Field Unit 2.3.1, 2.4.2, and 3.0 devices allow the injection of OS commands into cgi-bin/timeconfig.py via shell metacharacters in the NTP Server field...

CVE-2020-9025: Improper Neutralization of Input During Web Page Generation

Iteris Vantage Velocity Field Unit 2.4.2 devices have multiple stored XSS issues in all parameters of the Start Data Viewer feature of the /cgi-bin/loaddata.py script...

CVE-2020-9023: Weak Password Requirements

Iteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have two users that are not documented and are configured with weak passwords User bluetooth, password bluetooth; User eclipse, password eclipse. Also, bluetooth is the root password...

CVE-2020-9024: Incorrect Permission Assignment for Critical Resource

Iteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have world-writable permissions for the /root/cleardata.pl executed as root by crond and /root/loadperl.sh executed as root at boot time scripts...