PT-2020-14767 · Swisscom · Swisscom Internet Box 3+4

Published 2020-08-04 · Updated 2021-07-21 · CVE-2020-16134

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Swisscom Internet Box 2 versions prior to 10.04.38 Swisscom Internet Box Standard versions prior to 10.04.38 Swisscom Internet Box Plus versions prior to 10.04.38 Swisscom Internet Box 3 versions prior to 11.01.20 Swisscom Internet Box light versions prior to 08.06.06

Description An issue allows an attacker to create a user with elevated privileges on the Sysbus-API, given the credentials for the local Web interface or physical access to a device's plus or reset button. This can be used to modify local or remote SSH access, allowing a login session as the superuser.

Recommendations For Swisscom Internet Box 2 versions prior to 10.04.38, update to version 10.04.38 or later. For Swisscom Internet Box Standard versions prior to 10.04.38, update to version 10.04.38 or later. For Swisscom Internet Box Plus versions prior to 10.04.38, update to version 10.04.38 or later. For Swisscom Internet Box 3 versions prior to 11.01.20, update to version 11.01.20 or later. For Swisscom Internet Box light versions prior to 08.06.06, update to version 08.06.06 or later.

Fix

Related Identifiers

CVE-2020-16134

Affected Products

Swisscom Internet Box 2

Swisscom Internet Box 3

Swisscom Internet Box Plus

Swisscom Internet Box Standard

Swisscom Internet Box Light

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-16134 · Security Note
• https://swisscom.ch/content/dam/swisscom/de/about/nachhaltigkeit/digitale-schweiz/sicherheit/bug-bounty/files/cve-2020-16134.txt · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-16134 · Vendor Advisory
• https://swisscom.ch · Vendor Advisory