PT-2020-13038 · Vpncrypt · Vpncrypt M10

Published 2020-08-12 · Updated 2020-08-19 · CVE-2020-12107

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VPNCrypt M10 version 2.6.5

Description The Web portal of the WiFi module allows command injection via a text field, which enables full control over the module's Operating System.

Recommendations For VPNCrypt M10 version 2.6.5, consider restricting access to the Web portal of the WiFi module until a patch is available. As a temporary workaround, avoid using the text field that allows command injection to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2020-12107

Affected Products

Vpncrypt M10

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-12107 · Security Note
• https://stengg.com/media/1076253/vpncrypt-m10-cve-advisory-notice.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-12107 · Vendor Advisory
• https://stengg.com/cybersecurity · Vendor Advisory