PT-2020-18603 · Aterm · Aterm Sa3500G

Narumi Hirai · Published 2020-12-14 · Updated 2020-12-15 · CVE-2020-5636

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Aterm SA3500G firmware versions prior to Ver. 3.5.9

Description The issue allows an attacker with administrative privilege to send a specially crafted request to a specific URL, which may result in arbitrary command execution.

Recommendations For Aterm SA3500G firmware versions prior to Ver. 3.5.9, update to Ver. 3.5.9 or later to resolve the issue.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2020-5636

Affected Products

Aterm Sa3500G

References · 5

• https://necplatforms.co.jp/product/security_ap/info_20201211.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5636 · Security Note
• https://osv.dev/vulnerability/CVE-2020-5636 · Vendor Advisory
• https://jvn.jp/jp/JVN55917325/index.html · Note
• https://jvn.jp/en/jp/JVN55917325/index.html · Note