CVE-2020-6857

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 1.0%

from disclosure to weapon91 days

Published on NVDJan 21

1st PoC+91d

exploitation probability

1.0%top 41% of all CVEs

observed exploitation

nono source reports it

3 public exploit(s)

CarbonFTP v1.4 uses insecure proprietary password encryption with a hard-coded weak encryption key. The key for local FTP server passwords is hard-coded in the binary.

Affected products

n/a · n/a

public PoCs found — 3

exploitdbwww.exploit-db.com/exploits/48363unverified cve_referencepacketstormsecurity.com/files/157321/Neowise-CarbonFTP-1.4-Insecure-Proprietary-Password-Encryption.htmlunverified cve_referencepacketstormsecurity.com/files/156015/Neowise-CarbonFTP-1.4-Insecure-Proprietary-Password-Encryption.htmlunverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://hyp3rlinx.altervista.org http://packetstormsecurity.com/files/156015/Neowise-CarbonFTP-1.4-Insecure-Proprietary-Password-Encryption.html http://packetstormsecurity.com/files/157321/Neowise-CarbonFTP-1.4-Insecure-Proprietary-Password-Encryption.html http://seclists.org/fulldisclosure/2020/Jan/29 http://seclists.org/fulldisclosure/2020/Jan/35 https://seclists.org/bugtraq/2020/Jan/30