CVE-2020-15505criticalunder attackCWE-706

CVE-2020-15505

Published · Updated

Follow this CVE+ Monitor MobileIron Multiple Products

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 100%
from disclosure to weapon68 days
Published on NVDJul 7
1st PoC+68d
metasploit+67d
CISA KEV+484d
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

A critical vulnerability in MobileIron security software allows attackers to remotely execute malicious code on affected systems without authentication or user interaction. This could give attackers complete control over enterprise mobile device management infrastructure.

Technical detail

Remote code execution vulnerability affecting MobileIron Core, Connector, Sentry, and RDB components through unspecified attack vectors (CWE-706: Use of Externally-Controlled Format String). No authentication required; exploitation results in arbitrary code execution with system privileges on vulnerable versions through 10.6.0.0 and earlier.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0; and Sentry versions 9.7.2 and earlier, and 9.8.0; and Monitor and Reporting Database (RDB) version 2.0.0.1 and earlier that allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.