PT-2020-17098 · Sagemcom · Sagemcom F@St3486

Published 2020-11-27 · Updated 2021-07-21 · CVE-2020-29138

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAGEMCOM F@ST3486 NET DOCSIS 3.0 version NET 4.109.0

Description The issue allows remote unauthenticated users to download the router configuration file via the "/backupsettings.conf" API endpoint when any valid session is running. This is due to incorrect access control in the configuration backup path.

Recommendations For version NET 4.109.0, consider restricting access to the "/backupsettings.conf" API endpoint to prevent unauthorized downloads of the router configuration file until a patch is available.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2020-29138

Affected Products

Sagemcom F@St3486

References · 4

• 🔥 https://medium.com/@alexandrevvo/improper-access-control-in-the-sagemcom-router-model-f-st3486-net-797968e8adc8 · Exploit
• https://osv.dev/vulnerability/CVE-2020-29138 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-29138 · Security Note
• https://medium.com/%40alexandrevvo/improper-access-control-in-the-sagemcom-router-model-f-st3486-net-797968e8adc8 · Note