CVE-2020-12149mediumCWE-78

CVE-2020-12149: falha de média gravidade em Silver Peak Systems, Inc. ECOS

OS Command Injection - Management File Upload

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar ECOS

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.8epss 1.3%
The configuration backup/restore function in Silver Peak Unity ECOSTM (ECOS) appliance software was found to directly incorporate the user-controlled config filename in a subsequent shell command, allowing an attacker to manipulate the resulting command by injecting valid OS command input. This vulnerability can be exploited by an attacker with authenticated access to the Orchestrator UI or EdgeConnect UI. This affects all ECOS versions prior to: 8.1.9.15, 8.3.0.8, 8.3.1.2, 8.3.2.0, 9.0.2.0, and 9.1.0.0.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
Silver Peak Systems, Inc. · ECOS
CVEs relacionadas — Silver Peak Systems, Inc. ECOS

No mesmo produto, das mais perigosas para as menos.

CVE-2020-12148MEDIUMOS Command Injection - nslookup APIEPSS 2.1%