PT-2020-16768 · Verve Connect · Relish Vh510

Published 2020-11-04 · Updated 2020-11-10 · CVE-2020-27692

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Relish (Verve Connect) VH510 device with firmware before 1.0.1.6L0516

Description The Relish (Verve Connect) VH510 device contains multiple CSRF vulnerabilities within its web management portal. Attackers can use this to update the TR-069 configuration server settings, which are responsible for managing devices remotely. This makes it possible to remotely reboot the device or upload malicious firmware.

Recommendations For firmware versions before 1.0.1.6L0516, update the firmware to version 1.0.1.6L0516 or later to resolve the issue. As a temporary workaround, consider restricting access to the web management portal to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-27692

Affected Products

Relish Vh510

References · 7

• 🔥 https://6point6.co.uk/wp-content/uploads/2020/10/Relish-4G-VH510-Hub-Full-Disclosure-v1.3.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-27692 · Security Note
• https://osv.dev/vulnerability/CVE-2020-27692 · Vendor Advisory
• https://6point6.co.uk/insights/security-advisory-relish-4g-hub-vh510 · Note
• https://t.me/cibsecurity/15849 · Telegram Post
• https://t.me/cvenotify/5160 · Telegram Post
• https://t.me/cvenotify/5155 · Telegram Post