PT-2020-16010 · Host Engineering · H2-Ecom100+2

Published 2020-12-15 · Updated 2020-12-18 · CVE-2020-25195

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Host Engineering H0-ECOM100, H2-ECOM100, and H4-ECOM100 modules (affected versions not specified)

Description The issue arises because the length of input fields in the affected modules is verified only on the client side when receiving input from the configuration web server. This may allow an attacker to bypass the check and send input that could crash the device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2020-25195

Affected Products

H0-Ecom100

H2-Ecom100

H4-Ecom100

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-25195 · Security Note
• https://osv.dev/vulnerability/CVE-2020-25195 · Vendor Advisory
• https://t.me/cibsecurity/20878 · Telegram Post
• https://us-cert.cisa.gov/ics/advisories/icsa-20-345-02 · Note