PT-2020-16955 · Cellinx · Cellinx Nvt Web Server

Published 2020-11-06 · Updated 2020-11-19 · CVE-2020-28250

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cellinx NVT Web Server version 5.0.0.014b.test

Description The issue allows a remote user to run commands as root via SetFileContent.cgi because authentication is performed on the client side. This means that the authentication checks are done on the client's machine rather than on the server, which can be bypassed or manipulated by an attacker.

Recommendations For Cellinx NVT Web Server version 5.0.0.014b.test, consider disabling the SetFileContent.cgi script until a proper server-side authentication mechanism is implemented to prevent unauthorized access. Restrict access to the SetFileContent.cgi endpoint to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2020-28250

Affected Products

Cellinx Nvt Web Server

References · 4

• 🔥 https://github.com/summtime/CVE/tree/master/CVE-2020-28250 · Exploit
• https://osv.dev/vulnerability/CVE-2020-28250 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-28250 · Security Note
• https://t.me/cvenotify/5239 · Telegram Post