Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-5668 State: PUBLISHED Published: 2020-11-20T03:30:23 Last Updated: 2024-08-04T08:39:25.511Z Vendors: Mitsubishi Electric Corporation Products: MELSEC iQ-R Problem Types: Uncontrolled Resource Consumption Description: Uncontrolled resource consumption vulnerability in MELSEC iQ-R Series modules (R00/01/02CPU firmware version '19' and earlier, R04/08/16/32/120 (EN) CPU firmware version '51' and earlier, R08/16/32/120SFCPU firmware version '22' and earlier, R08/16/32/120PCPU firmware version '25' and earlier, R08/16/32/120PSFCPU firmware version '06' and earlier, RJ71EN71 firmware version '47' and earlier, RJ71GF11-T2 firmware version '47' and earlier, RJ72GF15-T2 firmware vers
er, RJ71EN71 firmware version '47' and earlier, RJ71GF11-T2 firmware version '47' and earlier, RJ72GF15-T2 firmware version '07' and earlier, RJ71GP21-SX firmware version '47' and earlier, RJ71GP21S-SX firmware version '47' and earlier, and RJ71GN11-T2 firmware version '11' and earlier) allows a remote unauthenticated attacker to cause an error in a CPU unit and cause a denial-of-service (DoS) condition in execution of the program and its communication, or to cause a denial-of-service (DoS) condition in communication via the unit by receiving a specially crafted SLMP packet Additional Analyst Notes: - CVE Program Container: References: - https://www.mitsubishielectric.co.jp/psirt/vulnerabili
Additional Analyst Notes: - CVE Program Container: References: - https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2020-016.pdf - https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-016_en.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-20-324-05 - https://jvn.jp/vu/JVNVU95980140/index.html
CVE ID: CVE-2020-5669 State: PUBLISHED Published: 2021-10-26T10:10:10 Last Updated: 2024-08-04T08:39:25.679Z Vendors: Six Apart Ltd. Products: Movable Type Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in Movable Type Movable Type Premium 1.37 and earlier and Movable Type Premium Advanced 1.37 and earlier allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.sixapart.jp/movabletype/news/2020/11/18-1101.html - https://jvn.jp/en/jp/JVN94245475/index.html
CVE ID: CVE-2020-5674 State: PUBLISHED Published: 2020-11-24T06:55:23 Last Updated: 2024-08-04T08:39:25.452Z Vendors: SEIKO EPSON CORPORATION Products: the installers of multiple SEIKO EPSON products Problem Types: Untrusted search path vulnerability Description: Untrusted search path vulnerability in the installers of multiple SEIKO EPSON products allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. Additional Analyst Notes: - CVE Program Container: References: - https://www.epson.jp/support/misc_t/201119_oshirase.htm - https://www.epson.jp/support/pdf/fy20-001_softwareList_20201106_b.pdf - https://jvn.jp/en/jp/JVN26835001/index.html
CVE ID: CVE-2020-5675 State: PUBLISHED Published: 2020-12-04T07:10:19 Last Updated: 2024-08-04T08:39:25.520Z Vendors: Mitsubishi Electric Corporation Products: GT21 model of GOT2000 series, GS21 model of GOT SIMPLE series, and Tension Controller LE7-40GU-L series Problem Types: Denial-of-service (DoS) Description: Out-of-bounds read vulnerability in GT21 model of GOT2000 series (GT2107-WTBD V01.39.000 and earlier, GT2107-WTSD V01.39.000 and earlier, GT2104-RTBD V01.39.000 and earlier, GT2104-PMBD V01.39.000 and earlier, and GT2103-PMBD V01.39.000 and earlier), GS21 model of GOT series (GS2110-WTBD V01.39.000 and earlier, GS2107-WTBD V01.39.000 and earlier, GS2110-WTBD-N V01.39.000 and earlie
GOT series (GS2110-WTBD V01.39.000 and earlier, GS2107-WTBD V01.39.000 and earlier, GS2110-WTBD-N V01.39.000 and earlier, and GS2107-WTBD-N V01.39.000 and earlier), and Tension Controller LE7-40GU-L series (LE7-40GU-L Screen package data for CC-Link IEF Basic V1.00, LE7-40GU-L Screen package data for MODBUS/TCP V1.00, and LE7-40GU-L Screen package data for SLMP V1.00) allows a remote attacker to cause a denial-of-service (DoS) condition by sending a specially crafted packet. As a result, deterioration of communication performance or a denial-of-service (DoS) condition of the TCP communication functions of the products may occur. Additional Analyst Notes: - CVE Program Container: References:
he TCP communication functions of the products may occur. Additional Analyst Notes: - CVE Program Container: References: - https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-017_en.pdf - https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2020-017.pdf - https://jvn.jp/vu/JVNVU99277775/index.html
CVE ID: CVE-2020-5676 State: PUBLISHED Published: 2020-12-03T11:15:31 Last Updated: 2024-08-04T08:39:25.482Z Vendors: WESEEK, Inc. Products: GROWI Problem Types: Information Disclosure Description: GROWI v4.1.3 and earlier allow remote attackers to obtain information which is not allowed to access via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/weseek/growi - https://hub.docker.com/r/weseek/growi/ - https://jvn.jp/en/jp/JVN56450373/index.html
CVE ID: CVE-2020-5677 State: PUBLISHED Published: 2020-12-03T11:15:32 Last Updated: 2024-08-04T08:39:25.646Z Vendors: WESEEK, Inc. Products: GROWI Problem Types: Cross-site scripting Description: Reflected cross-site scripting vulnerability in GROWI v4.0.0 and earlier allows remote attackers to inject arbitrary script via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/weseek/growi - https://hub.docker.com/r/weseek/growi/ - https://jvn.jp/en/jp/JVN56450373/index.html
CVE ID: CVE-2020-5678 State: PUBLISHED Published: 2020-12-03T11:15:32 Last Updated: 2024-08-04T08:39:25.526Z Vendors: WESEEK, Inc. Products: GROWI Problem Types: Cross-site scripting Description: Stored cross-site scripting vulnerability in GROWI v3.8.1 and earlier allows remote attackers to inject arbitrary script via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/weseek/growi - https://hub.docker.com/r/weseek/growi/ - https://jvn.jp/en/jp/JVN56450373/index.html
CVE ID: CVE-2020-5679 State: PUBLISHED Published: 2020-12-03T11:15:32 Last Updated: 2024-08-04T08:39:25.580Z Vendors: EC-CUBE CO.,LTD. Products: EC-CUBE Problem Types: Improper Restriction of Rendered UI Layers or Frames Description: Improper restriction of rendered UI layers or frames in EC-CUBE versions from 3.0.0 to 3.0.18 leads to clickjacking attacks. If a user accesses a specially crafted page while logged into the administrative page, unintended operations may be conducted. Additional Analyst Notes: - CVE Program Container: References: - https://www.ec-cube.net/info/weakness/ - https://jvn.jp/en/jp/JVN24457594/index.html
CVE ID: CVE-2020-5680 State: PUBLISHED Published: 2020-12-03T11:15:33 Last Updated: 2024-08-04T08:39:25.655Z Vendors: EC-CUBE CO.,LTD. Products: EC-CUBE Problem Types: Improper Input Validation Description: Improper input validation vulnerability in EC-CUBE versions from 3.0.5 to 3.0.18 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vector. Additional Analyst Notes: - CVE Program Container: References: - https://www.ec-cube.net/info/weakness/ - https://jvn.jp/en/jp/JVN24457594/index.html
CVE ID: CVE-2020-5681 State: PUBLISHED Published: 2020-12-24T01:20:20 Last Updated: 2024-08-04T08:39:25.694Z Vendors: SEIKO EPSON CORPORATION Products: EpsonNet SetupManager and Offirio SynergyWare PrintDirector Problem Types: Untrusted search path vulnerability Description: Untrusted search path vulnerability in self-extracting files created by EpsonNet SetupManager versions 2.2.14 and earlier, and Offirio SynergyWare PrintDirector versions 1.6x/1.6y and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. Additional Analyst Notes: - CVE Program Container: References: - https://www.epson.jp/support/misc_t/201217_oshirase.htm - https://jvn.jp/en/j
es: - CVE Program Container: References: - https://www.epson.jp/support/misc_t/201217_oshirase.htm - https://jvn.jp/en/jp/JVN94244575/index.html
CVE ID: CVE-2020-5682 State: PUBLISHED Published: 2020-12-16T07:45:18 Last Updated: 2024-08-04T08:39:25.628Z Vendors: WESEEK, Inc. Products: GROWI Problem Types: Improper Input Validation Description: Improper input validation in GROWI versions prior to v4.2.3 (v4.2 Series), GROWI versions prior to v4.1.12 (v4.1 Series), and GROWI v3 series and earlier GROWI versions prior to v4.2.3 (v4.2 Series), GROWI versions prior to v4.1.12 (v4.1 Series), and GROWI v3 series and earlier allows remote attackers to cause a denial of service via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/weseek/growi - https://hub.docker.com/r/weseek/growi/ - ht
es: - CVE Program Container: References: - https://github.com/weseek/growi - https://hub.docker.com/r/weseek/growi/ - https://jvn.jp/en/jp/JVN94169589/index.html
CVE ID: CVE-2020-5683 State: PUBLISHED Published: 2020-12-16T07:45:19 Last Updated: 2024-08-04T08:39:25.766Z Vendors: WESEEK, Inc. Products: GROWI Problem Types: Directory traversal Description: Directory traversal vulnerability in GROWI versions prior to v4.2.3 (v4.2 Series), GROWI versions prior to v4.1.12 (v4.1 Series), and GROWI v3 series and earlier GROWI versions prior to v4.2.3 (v4.2 Series), GROWI versions prior to v4.1.12 (v4.1 Series), and GROWI v3 series and earlier allows remote attackers to alter the data by uploading a specially crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/weseek/growi - https://hub.docker.com/r/weseek/growi/
t Notes: - CVE Program Container: References: - https://github.com/weseek/growi - https://hub.docker.com/r/weseek/growi/ - https://jvn.jp/en/jp/JVN94169589/index.html
CVE ID: CVE-2020-5684 State: PUBLISHED Published: 2020-12-24T01:20:20 Last Updated: 2024-08-04T08:39:25.823Z Vendors: NEC Corporation Products: Management software for NEC Storage disk array system Problem Types: Improper server certificate verification Description: iSM client versions from V5.1 prior to V12.1 running on NEC Storage Manager or NEC Storage Manager Express does not verify a server certificate properly, which allows a man-in-the-middle attacker to eavesdrop on an encrypted communication or alter the communication via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - https://jpn.nec.com/security-info/secinfo/nv20-015.html - https://jvn.jp/en
otes: - CVE Program Container: References: - https://jpn.nec.com/security-info/secinfo/nv20-015.html - https://jvn.jp/en/jp/JVN10100024/index.html
CVE ID: CVE-2020-5685 State: PUBLISHED Published: 2021-01-13T09:40:35 Last Updated: 2024-08-04T08:39:25.664Z Vendors: NEC Corporation Products: UNIVERGE SV9500/SV8500 series Problem Types: OS Command Injection Description: UNIVERGE SV9500 series from V1 to V7and SV8500 series from S6 to S8 allows an attacker to execute arbitrary OS commands or cause a denial-of-service (DoS) condition by sending a specially crafted request to a specific URL. Additional Analyst Notes: - CVE Program Container: References: - https://www.necplatforms.co.jp/en/press/security_adv.html - https://jvn.jp/en/jp/JVN38784555/index.html
CVE ID: CVE-2020-5686 State: PUBLISHED Published: 2021-01-13T09:40:36 Last Updated: 2024-08-04T08:39:25.708Z Vendors: NEC Corporation Products: UNIVERGE SV9500/SV8500 series Problem Types: Incorrect Implementation of Authentication Algorithm Description: Incorrect implementation of authentication algorithm issue in UNIVERGE SV9500 series from V1 to V7and SV8500 series from S6 to S8 allows an attacker to access the remote system maintenance feature and obtain the information by sending a specially crafted request to a specific URL. Additional Analyst Notes: - CVE Program Container: References: - https://www.necplatforms.co.jp/en/press/security_adv.html - https://jvn.jp/en/jp/JVN38784555/index
tainer: References: - https://www.necplatforms.co.jp/en/press/security_adv.html - https://jvn.jp/en/jp/JVN38784555/index.html
CVE ID: CVE-2020-5720 State: PUBLISHED Published: 2020-02-06T16:51:16 Last Updated: 2024-08-04T08:39:25.501Z Vendors: n/a Products: MikroTik WinBox Problem Types: CWE-22 Description: MikroTik WinBox before 3.21 is vulnerable to a path traversal vulnerability that allows creation of arbitrary files wherevere WinBox has write permissions. WinBox is vulnerable to this attack if it connects to a malicious endpoint or if an attacker mounts a man in the middle attack. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-07
CVE ID: CVE-2020-5721 State: PUBLISHED Published: 2020-04-15T20:50:45 Last Updated: 2024-08-04T08:39:25.683Z Vendors: n/a Products: MikroTik WinBox Problem Types: CWE-260 Description: MikroTik WinBox 3.22 and below stores the user's cleartext password in the settings.cfg.viw configuration file when the Keep Password field is set and no Master Password is set. Keep Password is set by default and, by default Master Password is not set. An attacker with access to the configuration file can extract a username and password to gain access to the router. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-23
CVE ID: CVE-2020-5722 State: PUBLISHED Published: 2020-03-23T19:31:40.000Z Last Updated: 2025-10-21T23:35:47.400Z Vendors: n/a Products: Grandstream UCM6200 Series Problem Types: SQL Injection, HTML Injection Description: The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker can use this vulnerability to execute shell commands as root on versions before 1.0.19.20 or inject HTML in password recovery emails in versions before 1.0.20.17. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2020-15 - http://packetstormsec
er: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2020-15 - http://packetstormsecurity.com/files/156876/UCM6202-1.0.18.13-Remote-Command-Injection.html - http://packetstormsecurity.com/files/165708/Grandstream-UCM62xx-IP-PBX-sendPasswordEmail-Remote-Code-Execution.html
CVE ID: CVE-2020-5723 State: PUBLISHED Published: 2020-03-30T19:03:22 Last Updated: 2024-08-04T08:39:25.688Z Vendors: n/a Products: Grandstream UCM6200 series Problem Types: CWE-312 Description: The UCM6200 series 1.0.20.22 and below stores unencrypted user passwords in an SQLite database. This could allow an attacker to retrieve all passwords and possibly gain elevated privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-17
CVE ID: CVE-2020-5724 State: PUBLISHED Published: 2020-03-30T19:03:32 Last Updated: 2024-08-04T08:39:25.685Z Vendors: n/a Products: Grandstream UCM6200 series Problem Types: CWE-89 Description: The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the HTTP server's websockify endpoint. A remote unauthenticated attacker can invoke the challenge action with a crafted username and discover user passwords. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-17
CVE ID: CVE-2020-5725 State: PUBLISHED Published: 2020-03-30T19:03:44 Last Updated: 2024-08-04T08:39:25.770Z Vendors: n/a Products: Grandstream UCM6200 series Problem Types: CWE-89 Description: The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the HTTP server's websockify endpoint. A remote unauthenticated attacker can invoke the login action with a crafted username and, through the use of timing attacks, can discover user passwords. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-17 - http://packetstormsecurity.com/files/156976/Grandstream-UCM6200-Series-WebSocket-1.0.20.20-SQL-Injection.
/tra-2020-17 - http://packetstormsecurity.com/files/156976/Grandstream-UCM6200-Series-WebSocket-1.0.20.20-SQL-Injection.html
CVE ID: CVE-2020-5726 State: PUBLISHED Published: 2020-03-30T19:03:52 Last Updated: 2024-08-04T08:39:25.691Z Vendors: n/a Products: Grandstream UCM6200 series Problem Types: CWE-89 Description: The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the CTI server on port 8888. A remote unauthenticated attacker can invoke the challenge action with a crafted username and discover user passwords. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-17 - http://packetstormsecurity.com/files/156977/Grandstream-UCM6200-Series-CTI-Interface-SQL-Injection.html
CVE ID: CVE-2020-5727 State: PUBLISHED Published: 2020-05-02T15:22:02 Last Updated: 2024-08-04T08:39:25.699Z Vendors: n/a Products: SimpliSafe SS3 Problem Types: Unauthenticated Keypad Pairing Vulnerability Description: Authentication bypass using an alternate path or channel in SimpliSafe SS3 firmware 1.4 allows a local, unauthenticated attacker to pair a rogue keypad to an armed system. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-29
CVE ID: CVE-2020-5728 State: PUBLISHED Published: 2020-04-17T18:29:48 Last Updated: 2024-08-04T08:39:25.688Z Vendors: n/a Products: OpenMRS Problem Types: Cross Site Scripting Description: OpenMRS 2.9 and prior copies "Referrer" header values into an html element named "redirectUrl" within many webpages (such as login.htm). There is insufficient validation for this parameter, which allows for the possibility of cross-site scripting. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-18
CVE ID: CVE-2020-5729 State: PUBLISHED Published: 2020-04-17T18:29:54 Last Updated: 2024-08-04T08:39:25.648Z Vendors: n/a Products: OpenMRS Problem Types: Cross Site Scripting Description: In OpenMRS 2.9 and prior, the UI Framework Error Page reflects arbitrary, user-supplied input back to the browser, which can result in XSS. Any page that is able to trigger a UI Framework Error is susceptible to this issue. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-18
CVE ID: CVE-2020-5730 State: PUBLISHED Published: 2020-04-17T18:29:59 Last Updated: 2024-08-04T08:39:25.665Z Vendors: n/a Products: OpenMRS Problem Types: Cross Site Scripting Description: In OpenMRS 2.9 and prior, the sessionLocation parameter for the login page is vulnerable to cross-site scripting. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-18
CVE ID: CVE-2020-5731 State: PUBLISHED Published: 2020-04-17T18:30:05 Last Updated: 2024-08-04T08:39:25.773Z Vendors: n/a Products: OpenMRS Problem Types: Cross Site Scripting Description: In OpenMRS 2.9 and prior, the app parameter for the ActiveVisit's page is vulnerable to cross-site scripting. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-18
CVE ID: CVE-2020-5732 State: PUBLISHED Published: 2020-04-17T18:27:00 Last Updated: 2024-08-04T08:39:25.692Z Vendors: n/a Products: OpenMRS Problem Types: Authentication Bypass Description: In OpenMRS 2.9 and prior, he import functionality of the Data Exchange Module does not properly redirect to a login page when an unauthenticated user attempts to access it. This allows unauthenticated users to use a feature typically restricted to administrators. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-18
CVE ID: CVE-2020-5733 State: PUBLISHED Published: 2020-04-17T18:27:07 Last Updated: 2024-08-04T08:39:25.743Z Vendors: n/a Products: OpenMRS Problem Types: Information Disclosure Description: In OpenMRS 2.9 and prior, the export functionality of the Data Exchange Module does not properly redirect to a login page when an unauthenticated user attempts to access it. This allows the export of potentially sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-18
CVE ID: CVE-2020-5734 State: PUBLISHED Published: 2020-04-07T13:05:07 Last Updated: 2024-08-04T08:39:25.556Z Vendors: n/a Products: SolarWinds Dameware Problem Types: Unauthenticated Remote Buffer Overflow Description: Classic buffer overflow in SolarWinds Dameware allows a remote, unauthenticated attacker to cause a denial of service by sending a large 'SigPubkeyLen' during ECDH key exchange. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-19
CVE ID: CVE-2020-5735 State: PUBLISHED Published: 2020-04-08T12:42:25.000Z Last Updated: 2025-10-21T23:35:47.086Z Vendors: n/a Products: Amcrest Problem Types: CWE-121 Description: Amcrest cameras and NVR are vulnerable to a stack-based buffer overflow over port 37777. An authenticated remote attacker can abuse this issue to crash the device and possibly execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2020-20 - http://packetstormsecurity.com/files/157164/Amcrest-Dahua-NVR-Camera-IP2M-841-Denial-Of-Service.html
CVE ID: CVE-2020-5736 State: PUBLISHED Published: 2020-04-08T12:42:22 Last Updated: 2024-08-04T08:39:25.743Z Vendors: n/a Products: Amcrest Problem Types: CWE-476 Description: Amcrest cameras and NVR are vulnerable to a null pointer dereference over port 37777. An authenticated remote attacker can abuse this issue to crash the device. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-20
CVE ID: CVE-2020-5737 State: PUBLISHED Published: 2020-04-17T18:24:29 Last Updated: 2024-08-04T08:39:25.524Z Vendors: n/a Products: Tenable.Sc Problem Types: Stored XSS Description: Stored XSS in Tenable.Sc before 5.14.0 could allow an authenticated remote attacker to craft a request to execute arbitrary script code in a user's browser session. Updated input validation techniques have been implemented to correct this issue. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/tns-2020-02
CVE ID: CVE-2020-5738 State: PUBLISHED Published: 2020-04-14T13:48:44 Last Updated: 2024-08-04T08:39:25.629Z Vendors: n/a Products: Grandstream GXP1600 Series Problem Types: CWE-59 Description: Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker uploads a specially crafted tar file to the HTTP /cgi-bin/upload_vpntar interface. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-22
CVE ID: CVE-2020-5739 State: PUBLISHED Published: 2020-04-14T13:48:50 Last Updated: 2024-08-04T08:39:25.705Z Vendors: n/a Products: Grandstream GXP1600 Series Problem Types: CWE-94 Description: Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker adds an OpenVPN up script to the phone's VPN settings via the "Additional Settings" field in the web interface. When the VPN's connection is established, the user defined script is executed with root privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-22