CVE-2020-25565

Published: Aug 11, 2021Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

In SapphireIMS 5.0, it is possible to use the hardcoded credential in clients (username: sapphire, password: ims) and gain access to the portal. Once the access is available, the attacker can inject malicious OS commands on “ping”, “traceroute” and “snmp” functions and execute code on the server.

Affected (1)

Products: Sapphireims: Sapphireims

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Sapphireims Sapphireims	Version 5.0

Related CWEs

Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

References (4)

https://vuln.shellcoder.party/2020/09/19/cve-2020-25565-sapphireims-unprivileged-user-remote-command-execution-on-server/

Source: cve@mitre.org

ExploitThird Party Advisory

https://vuln.shellcoder.party/tags/sapphireims/

Source: cve@mitre.org

ExploitThird Party Advisory

https://vuln.shellcoder.party/2020/09/19/cve-2020-25565-sapphireims-unprivileged-user-remote-command-execution-on-server/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://vuln.shellcoder.party/tags/sapphireims/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.