EUVD-2020-29658

Malware in sbrugna...

CVE-2020-8809

Gurux GXDLMS Director prior to 8.5.1905.1301 downloads updates to add-ins and OBIS code over an unencrypted HTTP connection. A man-in-the-middle attacker can prompt the user to download updates by modifying the contents of gurux.fi/obis/files.xml and gurux.fi/updates/updates.xml. Then, the attack...

Path traversal

An issue was discovered in Gurux GXDLMS Director through 8.5.1905.1301. When downloading OBIS codes, it does not verify that the downloaded files are actual OBIS codes and doesn't check for path traversal. This allows the attacker exploiting CVE-2020-8809 to send executable files and place them i...

CVE-2020-8809

Gurux GXDLMS Director pre-8.5.1905.1301 downloads updates over HTTP. A MITM can modify gurux.fi/obis/files.xml and gurux.fi/updates/updates.xml, causing downloaded files to be altered. This can lead to code execution via add-ins, and via OBIS codes when combined with CVE-2020-8810. Connected sour...