PT-2020-12453 · Teradici · Teradici Pcoip Management Console

Benjamin Heald · Published 2020-03-25 · Updated 2023-03-25 · CVE-2020-10965

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Teradici PCoIP Management Console versions 19.11.1 through 20.01.0

Description The issue allows for unauthenticated password resets via the "login/resetadminpassword" endpoint of the default admin account. This is only possible when the default admin account is not disabled.

Recommendations For versions 19.11.1 and 20.01.0, update to version 19.11.2 or 20.01.1 to resolve the issue. As a temporary workaround, consider disabling the default admin account until a patch is available.

Exploit

Fix

Improper Authentication

Missing Authentication

Weakness Enumeration

CWE-287

CWE-306

Related Identifiers

CVE-2020-10965

Affected Products

Teradici Pcoip Management Console

References · 5

• 🔥 https://healdb.tech/blog.html · Exploit
• https://help.teradici.com/s/article/3729 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10965 · Security Note
• https://osv.dev/vulnerability/CVE-2020-10965 · Vendor Advisory
• https://t.me/pentestingnews/34389 · Telegram Post