PT-2020-14390 · Thingssdk · Thingssdk Wifi Scanner

Abhishekherle · Published 2020-06-29 · Updated 2021-07-21 · CVE-2020-15362

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions thingsSDK WiFi Scanner version 1.0.1

Description The issue allows code injection because the wifiscanner.js component can be used with options to overwrite the default executable/binary path and its arguments, enabling an attacker to execute arbitrary code.

Recommendations For version 1.0.1, consider restricting the use of the wifiscanner.js component until a patch is available to prevent arbitrary code execution.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2020-15362

GHSA-M6RW-M2V9-7HX4

Affected Products

Thingssdk Wifi Scanner

References · 4

• 🔥 https://github.com/thingsSDK/wifiscanner/issues/1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-15362 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15362 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m6rw-m2v9-7hx4 · Vendor Advisory