PT-2020-15625 · Sagemcom · Sagemcom F@St 5280

Ryan Delaney · Published 2020-09-01 · Updated 2020-09-11 · CVE-2020-24034

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sagemcom F@ST 5280 version 1.150.61

Description The issue allows any authenticated user to perform a privilege escalation to any other user due to insecure deserialization. By making a request with valid sess id, nonce, and ha1 values inside of the serialized session cookie, an attacker may alter the user value inside of this cookie and assume the role and permissions of the specified user. This can lead to gaining the permissions of the internal account, which includes the ability to flash custom firmware to the router, resulting in a complete compromise.

Recommendations For Sagemcom F@ST 5280 version 1.150.61, as a temporary workaround, consider restricting access to the serialized session cookie until a patch is available. Avoid using the user value in the affected cookie to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2020-24034

Affected Products

Sagemcom F@St 5280

References · 7

• 🔥 http://packetstormsecurity.com/files/159026/Sagemcom-F-ST-5280-Privilege-Escalation.html · Exploit
• https://osv.dev/vulnerability/CVE-2020-24034 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24034 · Security Note
• https://support.sagemcom.com/fr/haut-debit · Vendor Advisory
• https://t.me/cybersecuritytechnologies/1683 · Telegram Post
• https://seclists.org/fulldisclosure/2020/Sep/3 · Note
• http://seclists.org/fulldisclosure/2020/Sep/3 · Note