PT-2026-1444 · Unknown · Snapgear Management Console

CVE-2020-36909 · Publicado 2026-01-06 · Atualizado 2026-01-06

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SnapGear Management Console version 3.1.5

Description The SnapGear Management Console contains a file manipulation issue that allows authenticated users to read, write, and delete files. The issue is related to the edit config files CGI script. Attackers can manipulate POST request parameters in the /cgi-bin/cgix/edit config files API endpoint to access and modify files outside the expected /etc/config/ directory.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the edit config files CGI script.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2020-36909

Produtos afetados

Snapgear Management Console

Referências · 8

• 🔥 https://packetstorm.news/files/id/157939 · Exploit
• 🔥 https://exploit-db.com/exploits/48556 · Exploit
• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2020-5568.php · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-36909 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2020-36909 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/182960 · Nota
• https://vulncheck.com/advisories/secure-computing-snapgear-management-console-sg-arbitrary-file-readwrite · Nota
• https://t.me/cveNotify/147862 · Publicação no Telegram