CVE-2020-16282

Published: Aug 20, 2020Modified: Nov 21, 2024

8.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Exploitability: 2.0 / Impact: 6.0

Source: NVD

Description

In the default configuration of Rangee GmbH RangeeOS 8.0.4, all components are executed in the context of the privileged root user. This may allow a local attacker to break out of the restricted environment or inject malicious code into the application and fully compromise the operating system.

Affected (1)

Products: Rangee: Rangeeos

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Rangee Rangeeos	Version 8.0.4

Related CWEs

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (2)

https://www.contextis.com/en/resources/advisories/cve-2020-16282

Source: cve@mitre.org

Third Party Advisory

https://www.contextis.com/en/resources/advisories/cve-2020-16282

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.