PT-2020-12329 · Gira · Gira Tks-Ip-Gateway

Julian Beier + 3 · Published 2020-05-07 · Updated 2020-05-12 · CVE-2020-10795

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Gira TKS-IP-Gateway version 4.0.7.7

Description The issue allows for authenticated remote code execution through the backup functionality of the web frontend.

Recommendations For version 4.0.7.7, consider disabling the backup functionality in the web frontend as a temporary workaround until a patch is available.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2020-10795

Affected Products

Gira Tks-Ip-Gateway

References · 5

• 🔥 https://research.hisolutions.com/2020/04/open-the-gates-insecurity-of-cloudless-smart-door-systems · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-10795 · Security Note
• https://osv.dev/vulnerability/CVE-2020-10795 · Vendor Advisory
• https://t.me/cvenotify/3649 · Telegram Post
• https://t.me/cvenotify/3650 · Telegram Post