CVE-2020-24552

Published: Sep 10, 2020Modified: Nov 21, 2024

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: NVD

Description

Atop Technology industrial 3G/4G gateway contains Command Injection vulnerability. Due to insufficient input validation, the device's web management interface allows attackers to inject specific code and execute system commands without privilege.

Affected (7)

Products: Atoptechnology: Se5901 Firmware, Se5901b Firmware, Se5904d Firmware, Se5908 Firmware, Se5908a Firmware, Se5916 Firmware, Se5916a Firmware

7 products

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Atoptechnology Se5901 Firmware	From 1.18 to 1.40

Running on/with	Platform Versions
Atoptechnology Se5901	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Atoptechnology Se5901b Firmware	From 1.18 to 1.40

Running on/with	Platform Versions
Atoptechnology Se5901b	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Atoptechnology Se5904d Firmware	From 1.18 to 1.40

Running on/with	Platform Versions
Atoptechnology Se5904d	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Atoptechnology Se5908 Firmware	From 1.18 to 1.40

Running on/with	Platform Versions
Atoptechnology Se5908	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Atoptechnology Se5908a Firmware	From 1.18 to 1.40

Running on/with	Platform Versions
Atoptechnology Se5908a	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Atoptechnology Se5916 Firmware	From 1.18 to 1.40

Running on/with	Platform Versions
Atoptechnology Se5916	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Atoptechnology Se5916a Firmware	From 1.18 to 1.40

Running on/with	Platform Versions
Atoptechnology Se5916a	All versions

Related CWEs

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (2)

https://www.twcert.org.tw/tw/cp-132-3956-608f1-1.html

Source: twcert@cert.org.tw

Third Party Advisory

https://www.twcert.org.tw/tw/cp-132-3956-608f1-1.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.