PT-2020-17241 · Lanit · Lan Atmservice M3 Atm Monitoring System

Dmitry Kuramin · Published 2020-12-10 · Updated 2020-12-14 · CVE-2020-29667

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Lan ATMService M3 ATM Monitoring System version 6.1.0

Description The issue allows a remote attacker to gain control over the system due to insufficient session expiration. This can be achieved by using a default cookie value, such as PHPSESSID=LANIT-IMANAGER.

Recommendations For Lan ATMService M3 ATM Monitoring System version 6.1.0, consider changing the default cookie value to a unique and secure value to prevent unauthorized access. As a temporary workaround, restrict access to the system until a patch is available. Avoid using the default PHPSESSID value in the affected system until the issue is resolved.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2020-29667

Affected Products

Lan Atmservice M3 Atm Monitoring System

References · 26

• 🔥 https://github.com/jet-pentest/CVE-2020-29667 · Exploit
• https://osv.dev/vulnerability/CVE-2020-29667 · Vendor Advisory
• http://lanatmservice.ru · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-29667 · Security Note
• https://t.me/cibsecurity/19031 · Telegram Post
• https://t.me/cibsecurity/18857 · Telegram Post
• https://t.me/cibsecurity/18780 · Telegram Post
• https://t.me/cibsecurity/18934 · Telegram Post
• https://t.me/cibsecurity/19011 · Telegram Post
• https://t.me/cibsecurity/18876 · Telegram Post
• https://t.me/cibsecurity/18721 · Telegram Post
• https://t.me/cibsecurity/18741 · Telegram Post
• https://t.me/cibsecurity/18973 · Telegram Post
• https://t.me/cibsecurity/18915 · Telegram Post
• https://t.me/cibsecurity/18992 · Telegram Post