CVE-2020-12148mediumCWE-78

CVE-2020-12148: fallo de gravedad media en Silver Peak Systems, Inc. ECOS

OS Command Injection - nslookup API

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear ECOS

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.8epss 2.1%
A command injection flaw identified in the nslookup API in Silver Peak Unity ECOSTM (ECOS) appliance software could allow an attacker to execute arbitrary commands with the privileges of the web server running on the EdgeConnect appliance. An attacker could exploit this vulnerability to establish an interactive channel, effectively taking control of the target system. This vulnerability can be exploited by an attacker with authenticated access to the Orchestrator UI or EdgeConnect UI. This affects all ECOS versions prior to : 8.1.9.15, 8.3.0.8, 8.3.1.2, 8.3.2.0, 9.0.2.0, and 9.1.0.0.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Productos afectados
Silver Peak Systems, Inc. · ECOS
CVEs relacionadas — Silver Peak Systems, Inc. ECOS

En el mismo producto, de las más peligrosas a las menos.

CVE-2020-12149MEDIUMOS Command Injection - Management File UploadEPSS 1.3%