CVE-2020-16281

Summary: CVE-2020-16281 affects RangeeOS 8.0.4 (Kommbox component) and can let a locally authenticated attacker escape a restricted environment and execute arbitrary code due to freely accessible context menus. The issue is documented across multiple sources (NVD, Red Hat, CNVD, etc.). What’s aff...

CVE-2020-16280

CVE-2020-16280 affects RangeeOS 8.0.4 modules, where credentials are stored in plaintext. A local attacker with OS access can obtain credentials for multiple users, including external-facing administrative services, domain users, and local administrators. The connected sources confirm plaintext c...

CVE-2020-16280

Multiple Rangee GmbH RangeeOS 8.0.4 modules store credentials in plaintext including credentials of users for several external facing administrative services, domain joined users, and local administrators. To exploit the vulnerability a local attacker must have access to the underlying operating...

CVE-2020-16279

CVE-2020-16279 : The Kommbox component in Rangee GmbH RangeeOS 8.0.4 is vulnerable to Remote Code Execution due to untrusted user input being passed to the command line without sanitization. Multiple connected sources (NVD, Red Hat, CNVD, CNVD, PRION, etc.) confirm this RCE on RangeeOS 8.0.4. The...

CVE-2020-16279

The Kommbox component in Rangee GmbH RangeeOS 8.0.4 is vulnerable to Remote Code Execution due to untrusted user supplied input being passed to the command line without sanitization...

CVE-2020-16281: Improper Encoding or Escaping of Output

The Kommbox component in Rangee GmbH RangeeOS 8.0.4 could allow a local authenticated attacker to escape from the restricted environment and execute arbitrary code due to unrestricted context menus being accessible...

CVE-2020-16280: Insufficiently Protected Credentials

Multiple Rangee GmbH RangeeOS 8.0.4 modules store credentials in plaintext including credentials of users for several external facing administrative services, domain joined users, and local administrators. To exploit the vulnerability a local attacker must have access to the underlying operating...

CVE-2020-16279: Improper Neutralization of Special Elements used in an OS Command

The Kommbox component in Rangee GmbH RangeeOS 8.0.4 is vulnerable to Remote Code Execution due to untrusted user supplied input being passed to the command line without sanitization...

PT-2020-14869

Name of the Vulnerable Software and Affected Versions RangeeOS version 8.0.4 Description The default configuration of RangeeOS executes all components in the context of the privileged root user, potentially allowing a local attacker to break out of the restricted environment or inject malicious...

PT-2020-14867

Name of the Vulnerable Software and Affected Versions RangeeOS version 8.0.4 Description The issue concerns the storage of credentials in plaintext by certain modules. This includes credentials for external facing administrative services, domain joined users, and local administrators. A local...

PT-2020-14866

Name of the Vulnerable Software and Affected Versions RangeeOS version 8.0.4 Description The issue arises from the Kommbox component's failure to sanitize untrusted user-supplied input before passing it to the command line, leading to Remote Code Execution. Recommendations For RangeeOS version...

PT-2020-14868

Name of the Vulnerable Software and Affected Versions RangeeOS version 8.0.4 Description The issue allows a local authenticated attacker to escape from the restricted environment and execute arbitrary code due to unrestricted context menus being accessible in the Kommbox component. Recommendation...

CVE-2020-16282: Improper Neutralization of Special Elements used in an OS Command

In the default configuration of Rangee GmbH RangeeOS 8.0.4, all components are executed in the context of the privileged root user. This may allow a local attacker to break out of the restricted environment or inject malicious code into the application and fully compromise the operating system...