PT-2020-14868 · Rangeeos · Rangeeos+1

Published 2020-08-20 · Updated 2020-08-26 · CVE-2020-16281

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RangeeOS version 8.0.4

Description The issue allows a local authenticated attacker to escape from the restricted environment and execute arbitrary code due to unrestricted context menus being accessible in the Kommbox component.

Recommendations For RangeeOS version 8.0.4, consider restricting access to the Kommbox component or limiting the functionality of context menus to prevent arbitrary code execution until a patch is available.

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

CVE-2020-16281

Affected Products

Kommbox

Rangeeos

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2020-16281 · Security Note
• https://osv.dev/vulnerability/CVE-2020-16281 · Vendor Advisory
• https://contextis.com/en/resources/advisories/cve-2020-16281 · Note