CVE-2020-29574criticalunder attackransomwareCWE-89

CVE-2020-29574

Published · Updated

Follow this CVE+ Monitor CyberoamOS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

58Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 9.8epss 4.7%
from disclosure to weapon
Published on NVDDec 11
CISA KEV+1518d
Action required by CISAfederal deadline: 2025-02-27

The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.

In short

An attacker can inject malicious SQL commands into the WebAdmin interface of Cyberoam OS without needing a password, allowing them to steal or manipulate all data in the database.

Technical detail

SQL injection vulnerability in Cyberoam OS WebAdmin accepts unsanitized user input in SQL queries, enabling unauthenticated remote attackers to execute arbitrary SQL statements with database privileges. Attack vector is network-based with no authentication required, leading to complete confidentiality, integrity, and availability compromise.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL statements remotely.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a