CVE-2020-3924

Published: Feb 27, 2020Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

DVR firmware in TAT-76 and TAT-77 series of products, provided by TONNET do not properly verify patch files. Attackers can inject a specific command into a patch file and gain access to the system.

Affected (8)

Products: Tonnet: Tat 77104g1 Firmware, Tat 70432n Firmware, Tat 71416g1 Firmware, Tat 71832g1 Firmware, Tat 76104g3 Firmware, Tat 76108g3 Firmware, Tat 76116g3 Firmware, Tat 76132g3 Firmware

8 products

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tonnet Tat 77104g1 Firmware	Up to tat-77104g1_20190107

Running on/with	Platform Versions
Tonnet Tat 77104g1	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tonnet Tat 70432n Firmware	Up to tat-77208g1_20181225

Running on/with	Platform Versions
Tonnet Tat 70432n	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tonnet Tat 71416g1 Firmware	Up to tat-71416g1_20181225

Running on/with	Platform Versions
Tonnet Tat 71416g1	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tonnet Tat 71832g1 Firmware	Up to tat-71832g1_20190510

Running on/with	Platform Versions
Tonnet Tat 71832g1	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tonnet Tat 76104g3 Firmware	Up to 20181220_76104g3

Running on/with	Platform Versions
Tonnet Tat 76104g3	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tonnet Tat 76108g3 Firmware	Up to 20181221_76208g3

Running on/with	Platform Versions
Tonnet Tat 76108g3	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tonnet Tat 76116g3 Firmware	Up to 20181221_76216g3

Running on/with	Platform Versions
Tonnet Tat 76116g3	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tonnet Tat 76132g3 Firmware	Up to tat-70832g3_20181221-1

Running on/with	Platform Versions
Tonnet Tat 76132g3	All versions

Related CWEs

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

References (4)

https://tvn.twcert.org.tw/taiwanvn/TVN-201910004

Source: twcert@cert.org.tw

Third Party Advisory

https://www.chtsecurity.com/news/4ef5eb3a-fdc3-4d78-8dd7-ec7213e2bbcf

Source: twcert@cert.org.tw

Third Party Advisory

https://tvn.twcert.org.tw/taiwanvn/TVN-201910004

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.chtsecurity.com/news/4ef5eb3a-fdc3-4d78-8dd7-ec7213e2bbcf

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.