PT-2020-12691 · Castle Rock · Castle Rock Snmpc Online

Published 2020-04-09 · Updated 2021-07-21 · CVE-2020-11557

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Castle Rock SNMPc Online versions 12.10.10 and earlier

Description An issue was discovered in Castle Rock SNMPc Online where it includes the username and password values in cleartext within each request's cookie value.

Recommendations For Castle Rock SNMPc Online versions 12.10.10 and earlier, update to a version released after 2020-01-28 to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the application to minimize the risk of exploitation.

Exploit

Fix

Cleartext Transmission of Sensitive Information

Insufficiently Protected Credentials

Weakness Enumeration

CWE-319

CWE-522

Related Identifiers

CVE-2020-11557

Affected Products

Castle Rock Snmpc Online

References · 5

• 🔥 https://medium.com/tsscyber/noc-noc-whos-there-your-nms-is-pwned-1826174e0dee · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-11557 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11557 · Vendor Advisory
• https://t.me/cibsecurity/11203 · Telegram Post
• https://t.me/cvenotify/2616 · Telegram Post