PT-2020-13283 · Ismartgate · Ismartgate Pro

Published 2020-09-24 · Updated 2020-09-27 · CVE-2020-12837

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions ismartgate PRO version 1.5.9

Description The issue allows malicious file uploads through the form used for uploading images to garage doors, requiring the use of PNG magic bytes.

Recommendations For ismartgate PRO version 1.5.9, consider restricting access to the image upload form until a fix is available, and ensure that all uploaded files are thoroughly validated to prevent malicious uploads.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2020-12837

Affected Products

Ismartgate Pro

References · 4

• 🔥 https://kth.diva-portal.org/smash/get/diva2:1464458/FULLTEXT01.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2020-12837 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12837 · Security Note
• https://ismartgate.com/secure-garage-door · Vendor Advisory