← Back

CVE-2020-15858

nvd nist
Published: Aug 21, 2020Modified: Jun 17, 2026

JSON object

Loading...
6.4
Vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Exploitability: 0.9 / Impact: 5.5
Source: NVD

Description

Some devices of Thales DIS (formerly Gemalto, formerly Cinterion) allow Directory Traversal by physically proximate attackers. The directory path access check of the internal flash file system can be circumvented. This flash file system can store application-specific data and data needed for customer Java applications, TLS and OTAP (Java over-the-air-provisioning) functionality. The affected products and releases are: BGS5 up to and including SW RN 02.000 / ARN 01.001.06 EHSx and PDSx up to and including SW RN 04.003 / ARN 01.000.04 ELS61 up to and including SW RN 02.002 / ARN 01.000.04 ELS81 up to and including SW RN 05.002 / ARN 01.000.04 PLS62 up to and including SW RN 02.000 / ARN 01.000.04

Affected (9)

Thalesgroup
9 products
Bgs5 Firmware
Ehs5 Firmware
Ehs8 Firmware
Ehs6 Firmware
Pds5 Firmware
Pds6 Firmware
Els61 Firmware
Els81 Firmware
Pls62 Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Bgs5 Firmware
Up to rn_02.000_\/_arn_01.001.06
Running on/withPlatform Versions
Thalesgroup
Bgs5
All versions
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Ehs5 Firmware
Up to rn_04.003_\/_arn_01.000.04
Running on/withPlatform Versions
Thalesgroup
Ehs5
All versions
Configuration C
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Ehs8 Firmware
Up to rn_04.003_\/_arn_01.000.04
Running on/withPlatform Versions
Thalesgroup
Ehs8
All versions
Configuration D
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Ehs6 Firmware
Up to rn_04.003_\/_arn_01.000.04
Running on/withPlatform Versions
Thalesgroup
Ehs6
All versions
Configuration E
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Pds5 Firmware
Up to rn_04.003_\/_arn_01.000.04
Running on/withPlatform Versions
Thalesgroup
Pds5
All versions
Configuration F
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Pds6 Firmware
Up to rn_04.003_\/_arn_01.000.04
Running on/withPlatform Versions
Thalesgroup
Pds6
All versions
Configuration G
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Els61 Firmware
Up to rn_02.002_\/_arn_01.000.04
Running on/withPlatform Versions
Thalesgroup
Els61
All versions
Configuration H
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Els81 Firmware
Up to rn_05.002_\/_arn_01.000.04
Running on/withPlatform Versions
Thalesgroup
Els81
All versions
Configuration I
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Pls62 Firmware
Up to rn_02.000_\/_arn_01.000.04
Running on/withPlatform Versions
Thalesgroup
Pls62
All versions

Related CWEs

CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (6)

Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.