Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
f damaging critical system files. Description: The file transfer component of TIBCO Software Inc.'s TIBCO Managed File Transfer Platform Server for IBM i contains a vulnerability that theoretically allows an attacker to perform unauthorized network file transfers to and from the file system accessible to the affected component. This vulnerability is exploitable when the configuration option 'Require Node Resp' is set to 'No'. In the event of a successful exploit, the attacker could theoretically read and write any file on the file system accessible to the affected component, thus fully affecting the confidentiality, integrity, and availability of the operating system hosting the deployment o
, thus fully affecting the confidentiality, integrity, and availability of the operating system hosting the deployment of the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Managed File Transfer Platform Server for IBM i: versions 7.1.0 and below, version 8.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://www.tibco.com/services/support/advisories - https://www.tibco.com/support/advisories/2020/06/tibco-security-advisory-june-9-2020-tibco-managed-file-transfer-2020-9411
CVE ID: CVE-2020-9412 State: PUBLISHED Published: 2020-06-09T17:00:21.287841Z Last Updated: 2024-09-17T00:35:28.475Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: TIBCO Software Inc. Products: TIBCO Managed File Transfer Platform Server for IBM i Problem Types: The impact of this vulnerability includes the possibility that an unauthenticated attacker could execute arbitrary commands on the system. Description: The file transfer component of TIBCO Software Inc.'s TIBCO Managed File Transfer Platform Server for IBM i contains a vulnerability that theoretically allows execution of arbitrary commands at the privilege level of the affected system following a f
ty that theoretically allows execution of arbitrary commands at the privilege level of the affected system following a failed file transfer. Affected releases are TIBCO Software Inc.'s TIBCO Managed File Transfer Platform Server for IBM i: versions 7.1.0 and below, version 8.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://www.tibco.com/services/support/advisories - https://www.tibco.com/support/advisories/2020/06/tibco-security-advisory-june-9-2020-tibco-managed-file-transfer-2020-9412
CVE ID: CVE-2020-9413 State: PUBLISHED Published: 2020-06-30T19:40:14.183392Z Last Updated: 2024-09-17T01:07:05.625Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: TIBCO Software Inc. Products: TIBCO Managed File Transfer Command Center, TIBCO Managed File Transfer Internet Server Problem Types: The impact of this vulnerability includes the possibility that an attacker can gain access to the session ID of the affected user's session and take any action the affected user has privilege to perform. Description: The MFT Browser file transfer client and MFT Browser admin client components of TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center and TI
lient and MFT Browser admin client components of TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center and TIBCO Managed File Transfer Internet Server contain a vulnerability that theoretically allows an attacker to craft an URL that will execute arbitrary commands on the affected system. If the attacker convinces an authenticated user with a currently active session to enter or click on the URL the commands will be executed on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center: versions 8.2.1 and below and TIBCO Managed File Transfer Internet Server: versions 8.2.1 and below. Additional Analyst Notes: - CVE Program Containe
TIBCO Managed File Transfer Internet Server: versions 8.2.1 and below. Additional Analyst Notes: - CVE Program Container: References: - http://www.tibco.com/services/support/advisories
CVE ID: CVE-2020-9414 State: PUBLISHED Published: 2020-06-30T19:40:14.588996Z Last Updated: 2024-09-17T01:41:47.701Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: TIBCO Software Inc. Products: TIBCO Managed File Transfer Command Center, TIBCO Managed File Transfer Internet Server Problem Types: The impact of this vulnerability includes the possibility that an attacker could gain administrative control of the affected system. Description: The MFT admin service component of TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center and TIBCO Managed File Transfer Internet Server contains a vulnerability that theoretically allows an authenticated user wit
TIBCO Managed File Transfer Internet Server contains a vulnerability that theoretically allows an authenticated user with specific permissions to obtain the session identifier of another user. The session identifier when replayed could provide administrative rights or file transfer permissions to the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center: versions 8.2.1 and below and TIBCO Managed File Transfer Internet Server: versions 8.2.1 and below. Additional Analyst Notes: - CVE Program Container: References: - http://www.tibco.com/services/support/advisories
CVE ID: CVE-2020-9415 State: PUBLISHED Published: 2020-08-18T18:50:11.750129Z Last Updated: 2024-09-16T17:04:04.831Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: TIBCO Software Inc. Products: TIBCO Data Virtualization, TIBCO Data Virtualization for AWS Marketplace Problem Types: The impact of these vulnerabilities includes the theoretical possibility that a malicious user could exfiltrate any data file on the affected system. The malicious user cannot modify or delete any files on the affected system with this vulnerability. Description: The TIBCO Data Virtualization Server component of TIBCO Software Inc.'s TIBCO Data Virtualization and TIBCO Data Virtua
The TIBCO Data Virtualization Server component of TIBCO Software Inc.'s TIBCO Data Virtualization and TIBCO Data Virtualization for AWS Marketplace contains a vulnerability that theoretically allows a malicious authenticated user to download any arbitrary file from the affected system. The user must be authenticated and have privileges required to monitor the server in an operational capacity. Affected releases are TIBCO Software Inc.'s TIBCO Data Virtualization: versions 7.0.8 and below, versions 8.0.0, 8.1.0, 8.1.1, and 8.2.0 and TIBCO Data Virtualization for AWS Marketplace: versions 8.2.0 and below. Additional Analyst Notes: - CVE Program Container: References: - http://www.tibco.com/se
lace: versions 8.2.0 and below. Additional Analyst Notes: - CVE Program Container: References: - http://www.tibco.com/services/support/advisories - https://www.tibco.com/support/advisories/2020/08/tibco-security-advisory-august-18-2020-tibco-data-virtualization
CVE ID: CVE-2020-9416 State: PUBLISHED Published: 2020-09-15T18:55:11.663340Z Last Updated: 2024-09-16T19:20:42.329Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L) Vendors: TIBCO Software Inc. Products: TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, TIBCO Spotfire Server Problem Types: The theoretical impact of this vulnerability is that the attacker can execute scripts on the affected system of the victim that will execute with the privileges of the victim. If the victim has administrative privileges the attacker's injected scripts would allow the attacker to access all files, stop/start some services and change
ileges the attacker's injected scripts would allow the attacker to access all files, stop/start some services and change limited configuration settings. Description: The Spotfire client component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, and TIBCO Spotfire Server contains a vulnerability that theoretically allows a legitimate user to inject scripts. If executed by a victim authenticated to the affected system these scripts will be executed at the privileges of the victim. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analyst: versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0, TIBCO Spotfire Analytic
are TIBCO Software Inc.'s TIBCO Spotfire Analyst: versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1, TIBCO Spotfire Desktop: versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0, and TIBCO Spotfire Server: versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1. Additional Analyst Notes: - CVE Program Container: References: - http://www.tibco.com/services/support/advisories - https://www.tibco.com/support/advisories/2020/09/tibco-security-advisory-september-15-2020-tibco-spotfire
CVE ID: CVE-2020-9417 State: PUBLISHED Published: 2020-10-20T21:13:25.229968Z Last Updated: 2024-09-17T03:02:27.461Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L) Vendors: TIBCO Software Inc. Products: TIBCO Foresight Archive and Retrieval System, TIBCO Foresight Archive and Retrieval System Healthcare Edition, TIBCO Foresight Operational Monitor, TIBCO Foresight Operational Monitor Healthcare Edition, TIBCO Foresight Transaction Insight, TIBCO Foresight Transaction Insight Healthcare Edition Problem Types: The impact of these vulnerabilities includes the theoretical possibility that an authenticated attacker could craft a SQL query that would allow the attacker to c
es the theoretical possibility that an authenticated attacker could craft a SQL query that would allow the attacker to create records, and read, update or delete entries in a victim’s account. Description: The Transaction Insight reporting component of TIBCO Software Inc.'s TIBCO Foresight Archive and Retrieval System, TIBCO Foresight Archive and Retrieval System Healthcare Edition, TIBCO Foresight Operational Monitor, TIBCO Foresight Operational Monitor Healthcare Edition, TIBCO Foresight Transaction Insight, and TIBCO Foresight Transaction Insight Healthcare Edition contains a vulnerability that theoretically allows an authenticated attacker to perform SQL injection. Affected releases are
ins a vulnerability that theoretically allows an authenticated attacker to perform SQL injection. Affected releases are TIBCO Software Inc.'s TIBCO Foresight Archive and Retrieval System: versions 5.1.0 and below, version 5.2.0, TIBCO Foresight Archive and Retrieval System Healthcare Edition: versions 5.1.0 and below, version 5.2.0, TIBCO Foresight Operational Monitor: versions 5.1.0 and below, version 5.2.0, TIBCO Foresight Operational Monitor Healthcare Edition: versions 5.1.0 and below, version 5.2.0, TIBCO Foresight Transaction Insight: versions 5.1.0 and below, version 5.2.0, and TIBCO Foresight Transaction Insight Healthcare Edition: versions 5.1.0 and below, version 5.2.0. Additional
5.2.0, and TIBCO Foresight Transaction Insight Healthcare Edition: versions 5.1.0 and below, version 5.2.0. Additional Analyst Notes: - CVE Program Container: References: - http://www.tibco.com/services/support/advisories
CVE ID: CVE-2020-9418 State: PUBLISHED Published: 2020-03-05T15:23:48 Last Updated: 2024-08-04T10:26:16.174Z Vendors: n/a Products: n/a Problem Types: n/a Description: An untrusted search path vulnerability in the installer of PDFescape Desktop version 4.0.22 and earlier allows an attacker to gain privileges and execute code via DLL hijacking. Additional Analyst Notes: - CVE Program Container: References: - https://support.pdfescape.com/hc/en-us/articles/360039586551
CVE ID: CVE-2020-9419 State: PUBLISHED Published: 2022-12-14T00:00:00.000Z Last Updated: 2025-04-22T02:47:28.687Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple stored cross-site scripting (XSS) vulnerabilities in Arcadyan Wifi routers VRV9506JAC23 allow remote attackers to inject arbitrary web script or HTML via the hostName and domain_name parameters present in the LAN configuration section of the administrative dashboard. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/AsherDLL/03d0762b5a535e300f1121caebe333ce
CVE ID: CVE-2020-9420 State: PUBLISHED Published: 2022-12-14T00:00:00.000Z Last Updated: 2025-04-22T02:45:14.570Z Vendors: n/a Products: n/a Problem Types: n/a Description: The login password of the web administrative dashboard in Arcadyan Wifi routers VRV9506JAC23 is sent in cleartext, allowing an attacker to sniff and intercept traffic to learn the administrative credentials to the router. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/AsherDLL/03d0762b5a535e300f1121caebe333ce
CVE ID: CVE-2020-9423 State: PUBLISHED Published: 2020-03-18T21:04:55 Last Updated: 2024-08-04T10:26:16.250Z Vendors: n/a Products: n/a Problem Types: n/a Description: LogicalDoc before 8.3.3 could allow an attacker to upload arbitrary files, leading to command execution or retrieval of data from the database. LogicalDoc provides a functionality to add documents. Those documents could then be used for multiple tasks, such as version control, shared among users, applying tags, etc. This functionality could be abused by an unauthenticated attacker to upload an arbitrary file in a restricted folder. This would lead to the executions of malicious commands with root privileges. Additional Analyst
in a restricted folder. This would lead to the executions of malicious commands with root privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.coresecurity.com/advisories/logicaldoc-virtual-appliance-multiple-vulnerabilities
CVE ID: CVE-2020-9425 State: PUBLISHED Published: 2020-03-20T17:42:54 Last Updated: 2024-08-04T10:26:16.079Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in includes/head.inc.php in rConfig before 3.9.4. An unauthenticated attacker can retrieve saved cleartext credentials via a GET request to settings.php. Because the application was not exiting after a redirect is applied, the rest of the page still executed, resulting in the disclosure of cleartext credentials in the response. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rconfig/rconfig/commit/20f4e3d87e84663d922b937842fddd9af1b68dd9 - https://blog.hivint.com/rcon
ces: - https://github.com/rconfig/rconfig/commit/20f4e3d87e84663d922b937842fddd9af1b68dd9 - https://blog.hivint.com/rconfig-3-9-3-unauthenticated-sensitive-information-disclosure-ead4ed88f153
CVE ID: CVE-2020-9426 State: PUBLISHED Published: 2020-06-15T14:55:16 Last Updated: 2024-08-04T10:26:16.125Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX Guard 2.10.3 and earlier allows XSS. Additional Analyst Notes: - CVE Program Container: References: - https://www.open-xchange.com/ - https://seclists.org/fulldisclosure/2020/Jun/20 - http://packetstormsecurity.com/files/158069/OX-Guard-2.10.3-Cross-Site-Scripting-Server-Side-Request-Forgery.html
CVE ID: CVE-2020-9427 State: PUBLISHED Published: 2020-06-15T14:52:22 Last Updated: 2024-08-04T10:26:16.112Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX Guard 2.10.3 and earlier allows SSRF. Additional Analyst Notes: - CVE Program Container: References: - https://www.open-xchange.com/ - https://seclists.org/fulldisclosure/2020/Jun/20 - http://packetstormsecurity.com/files/158069/OX-Guard-2.10.3-Cross-Site-Scripting-Server-Side-Request-Forgery.html
CVE ID: CVE-2020-9428 State: PUBLISHED Published: 2020-02-27T22:06:50 Last Updated: 2024-08-04T10:26:16.263Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the EAP dissector could crash. This was addressed in epan/dissectors/packet-eap.c by using more careful sscanf parsing. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16397 - https://www.wireshark.org/security/wnpa-sec-2020-05.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=9fe2de783dbcbe74144678d60a4e3923367044b2 - http://lists.opensuse.org/opensuse-security-ann
=wireshark.git%3Ba=commit%3Bh=9fe2de783dbcbe74144678d60a4e3923367044b2 - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZBICEY2HGSNQ3RPBLMDDYVAHGOGS4E2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDVMBCADP73TBISYCS6ARKOSNNJOGXXZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XN2GMGLT5XND7U34WX3O23WKUZ7JHMVN/ - https://security.gentoo.org/glsa/202007-13 - https://lists.debian.org/debian-lts-announce/2021/02/msg00008.html
CVE ID: CVE-2020-9429 State: PUBLISHED Published: 2020-02-27T22:06:39 Last Updated: 2024-08-04T10:26:16.091Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 3.2.0 to 3.2.1, the WireGuard dissector could crash. This was addressed in epan/dissectors/packet-wireguard.c by handling the situation where a certain data structure intentionally has a NULL value. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16394 - https://www.wireshark.org/security/wnpa-sec-2020-06.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=a2530f740d67d41908e84434bb5ec99480c2ac2e - https://code.wireshar
eshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=a2530f740d67d41908e84434bb5ec99480c2ac2e - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=73c5fff899f253c44a72657048aec7db6edee571 - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html - https://security.gentoo.org/glsa/202007-13
CVE ID: CVE-2020-9430 State: PUBLISHED Published: 2020-02-27T22:06:26 Last Updated: 2024-08-04T10:26:16.188Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the WiMax DLMAP dissector could crash. This was addressed in plugins/epan/wimax/msg_dlmap.c by validating a length field. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16368 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16383 - https://www.wireshark.org/security/wnpa-sec-2020-04.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=93d6b03a67953b82880cdbdcf0d3
-sec-2020-04.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=93d6b03a67953b82880cdbdcf0d30e2a3246d790 - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=6b98dc63701b1da1cc7681cb383dabb0b7007d73 - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZBICEY2HGSNQ3RPBLMDDYVAHGOGS4E2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDVMBCADP73TBISYCS6ARKOSNNJOGXXZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XN2GMGLT5X
SNNJOGXXZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XN2GMGLT5XND7U34WX3O23WKUZ7JHMVN/ - https://security.gentoo.org/glsa/202007-13 - https://lists.debian.org/debian-lts-announce/2021/02/msg00008.html
CVE ID: CVE-2020-9431 State: PUBLISHED Published: 2020-02-27T22:06:10 Last Updated: 2024-08-04T10:26:16.096Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the LTE RRC dissector could leak memory. This was addressed in epan/dissectors/packet-lte-rrc.c by adjusting certain append operations. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16341 - https://www.wireshark.org/security/wnpa-sec-2020-03.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=086003c9d616906e08bbeeab9c17b3aa4c6ff850 - http://lists.opensuse.org/opens
/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=086003c9d616906e08bbeeab9c17b3aa4c6ff850 - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZBICEY2HGSNQ3RPBLMDDYVAHGOGS4E2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDVMBCADP73TBISYCS6ARKOSNNJOGXXZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XN2GMGLT5XND7U34WX3O23WKUZ7JHMVN/ - https://security.gentoo.org/glsa/202007-13 - https://lists.debian.org/debian-lts-announce/2021/02/msg00008.html
CVE ID: CVE-2020-9432 State: PUBLISHED Published: 2020-02-27T22:40:15 Last Updated: 2024-08-04T10:26:16.135Z Vendors: n/a Products: n/a Problem Types: n/a Description: openssl_x509_check_host in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua_pushboolean for certain non-boolean return values. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zhaozg/lua-openssl/commit/a6dc186dd4b6b9e329a93cca3e7e3cfccfdf3cca
CVE ID: CVE-2020-9433 State: PUBLISHED Published: 2020-02-27T22:40:06 Last Updated: 2024-08-04T10:26:16.079Z Vendors: n/a Products: n/a Problem Types: n/a Description: openssl_x509_check_email in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua_pushboolean for certain non-boolean return values. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zhaozg/lua-openssl/commit/a6dc186dd4b6b9e329a93cca3e7e3cfccfdf3cca
CVE ID: CVE-2020-9434 State: PUBLISHED Published: 2020-02-27T22:39:57 Last Updated: 2024-08-04T10:26:16.128Z Vendors: n/a Products: n/a Problem Types: n/a Description: openssl_x509_check_ip_asc in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua_pushboolean for certain non-boolean return values. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zhaozg/lua-openssl/commit/a6dc186dd4b6b9e329a93cca3e7e3cfccfdf3cca
CVE ID: CVE-2020-9435 State: PUBLISHED Published: 2020-03-12T13:25:33 Last Updated: 2024-08-04T10:26:16.091Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHOENIX CONTACT TC ROUTER 3002T-4G through 2.05.3, TC ROUTER 2002T-3G through 2.05.3, TC ROUTER 3002T-4G VZW through 2.05.3, TC ROUTER 3002T-4G ATT through 2.05.3, TC CLOUD CLIENT 1002-4G through 2.03.17, and TC CLOUD CLIENT 1002-TXTX through 1.03.17 devices contain a hardcoded certificate (and key) that is used by default for web-based services on the device. Impersonation, man-in-the-middle, or passive decryption attacks are possible if the generic certificate is not replaced by a device-specific certificate during installat
yption attacks are possible if the generic certificate is not replaced by a device-specific certificate during installation. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/en-us/advisories/ - https://cert.vde.com/en-us/advisories/vde-2020-003 - http://seclists.org/fulldisclosure/2020/Mar/15 - http://packetstormsecurity.com/files/156729/Phoenix-Contact-TC-Router-TC-Cloud-Client-Command-Injection.html