CVE-2020-10208 - Vulnerability Details - OpenCVE

ReportizFlow

Command Injection in EntoneWebEngine in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7Xx series and Kami7B allows authenticated remote attackers to execute arbitrary commands with root user privileges.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

AV:N/AC:L/Au:S/C:C/I:C/A:C

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Amino	Ak45x Ak45x Firmware Ak5xx Ak5xx Firmware Ak65x Ak65x Firmware Aria6xx Aria6xx Firmware Aria7xx Aria7xx Firmware Kami7b Kami7b Firmware

Configuration 1 [-]

AND

cpe:2.3:o:amino:ak45x_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:amino:ak45x:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:amino:ak5xx_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:amino:ak5xx:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:amino:ak65x_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:amino:ak65x:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:amino:aria6xx_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:amino:aria6xx:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:amino:aria7xx_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:amino:aria7xx:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND

cpe:2.3:o:amino:kami7b_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:amino:kami7b:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://andre-oudhof.medium.com/pwning-my-isps-stbs-c5e78544274d#9cf3

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2020-12-29T23:41:12

Updated: 2024-08-04T10:58:39.621Z

Reserved: 2020-03-06T00:00:00

Link: CVE-2020-10208

Vulnrichment

No data.

NVD

Status : Modified

Published: 2020-12-30T00:15:12.597

Modified: 2024-11-21T04:54:58.000

Link: CVE-2020-10208

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2020-12-18T00:00:00", "descriptions": [{"lang": "en", "value": "Command Injection in EntoneWebEngine in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7Xx series and Kami7B allows authenticated remote attackers to execute arbitrary commands with root user privileges."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-12-29T23:41:12", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://andre-oudhof.medium.com/pwning-my-isps-stbs-c5e78544274d#9cf3"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2020-10208", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Command Injection in EntoneWebEngine in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7Xx series and Kami7B allows authenticated remote attackers to execute arbitrary commands with root user privileges."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://andre-oudhof.medium.com/pwning-my-isps-stbs-c5e78544274d#9cf3", "refsource": "MISC", "url": "https://andre-oudhof.medium.com/pwning-my-isps-stbs-c5e78544274d#9cf3"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T10:58:39.621Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://andre-oudhof.medium.com/pwning-my-isps-stbs-c5e78544274d#9cf3"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2020-10208", "datePublished": "2020-12-29T23:41:12", "dateReserved": "2020-03-06T00:00:00", "dateUpdated": "2024-08-04T10:58:39.621Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:amino:ak45x_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "A76D2886-66B2-4799-96C8-E00D961A91F7", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:amino:ak45x:-:*:*:*:*:*:*:*", "matchCriteriaId": "76A99F2F-7D78-490E-80E1-C6365086927A", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:amino:ak5xx_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "50613865-0630-4A8B-9926-28A28DBA81F6", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:amino:ak5xx:-:*:*:*:*:*:*:*", "matchCriteriaId": "B705E2F1-531C-4C54-80AB-D60F6B0502C0", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:amino:ak65x_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "487267C4-706E-48CF-AFF1-19F41F8DB917", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:amino:ak65x:-:*:*:*:*:*:*:*", "matchCriteriaId": "85E252BA-19CD-46CD-B28D-7244C15BD2E1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:amino:aria6xx_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "8E5B6C05-BF1B-418C-9E63-EA3BD2F5BF07", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:amino:aria6xx:-:*:*:*:*:*:*:*", "matchCriteriaId": "3A1289FA-97E8-4425-90A2-6106C1A3D2D1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:amino:aria7xx_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "28C2F709-6152-4EDA-8E4C-4B36298C2E11", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:amino:aria7xx:-:*:*:*:*:*:*:*", "matchCriteriaId": "A04DE3CC-DAC8-47A6-97FF-9218A0A3A7B0", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:amino:kami7b_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "99CC4665-08AE-4DAE-B6E0-917188767345", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:amino:kami7b:-:*:*:*:*:*:*:*", "matchCriteriaId": "0CE3E103-579F-42B2-952A-3E8BEEB72684", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Command Injection in EntoneWebEngine in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7Xx series and Kami7B allows authenticated remote attackers to execute arbitrary commands with root user privileges."}, {"lang": "es", "value": "Una Inyecci\u00f3n de Comandos en EntoneWebEngine en Amino Communications serie AK45x, serie AK5xx, serie AK65x, serie Aria6xx, serie Aria7/AK7Xx y Kami7B, permite a atacantes remotos autenticados ejecutar comandos arbitrarios con privilegios de usuario root"}], "evaluatorComment": "The products as shown in the CPE configuration are placeholders for each product series.", "id": "CVE-2020-10208", "lastModified": "2024-11-21T04:54:58.000", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "COMPLETE", "baseScore": 9.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "[email protected]", "type": "Primary"}]}, "published": "2020-12-30T00:15:12.597", "references": [{"source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"], "url": "https://andre-oudhof.medium.com/pwning-my-isps-stbs-c5e78544274d#9cf3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://andre-oudhof.medium.com/pwning-my-isps-stbs-c5e78544274d#9cf3"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-78"}], "source": "[email protected]", "type": "Primary"}]}