PT-2020-12678 · 3Xlogic · Infinias Eidc32

Published 2020-04-04 · Updated 2021-07-21 · CVE-2020-11542

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions 3xLOGIC Infinias eIDC32 version 2.213

Description The issue allows authentication bypass via the CMD.HTM endpoint, specifically when the CMD parameter is used, because authentication relies on the client-side interpretation of the MYKEY substring.

Recommendations For version 2.213, as a temporary workaround, consider restricting access to the CMD.HTM endpoint until a patch is available. Avoid using the CMD parameter in the CMD.HTM endpoint to minimize the risk of exploitation.

Exploit

Fix

Improper Authentication

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-287

CWE-319

Related Identifiers

CVE-2020-11542

Affected Products

Infinias Eidc32

References · 3

• 🔥 https://criticalstart.com/authentication-bypass-vulnerability-discovered-in-infinias-eidc32-webserver · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-11542 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11542 · Vendor Advisory