PT-2020-19296 · Blackberry · Qnx Slinger Web Server+1

Published 2020-08-12 · Updated 2025-08-22 · CVE-2020-6932

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions BlackBerry QNX Software Development Platform versions 6.4.0 through 6.6.0

Description The issue is related to an information disclosure and remote code execution vulnerability in the slinger web server. This could allow an attacker to read arbitrary files and run arbitrary executables in the context of the web server. The vulnerability involves directory traversal and remote code execution (RCE) in the QNX Slinger web server.

Recommendations For BlackBerry QNX Software Development Platform versions 6.4.0 through 6.6.0, consider disabling the slinger web server until a patch is available to prevent potential exploitation. Restrict access to sensitive files and directories to minimize the risk of information disclosure. As a temporary workaround, limit the execution of arbitrary executables in the context of the web server. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-150

Related Identifiers

CVE-2020-6932

Affected Products

Qnx Slinger Web Server

Qnx Software Development Platform

References · 6

• http://support.blackberry.com/kb/articleDetail?articleNumber=000061411 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6932 · Security Note
• https://osv.dev/vulnerability/CVE-2020-6932 · Vendor Advisory
• https://t.me/defcon_news/54412 · Telegram Post
• https://t.me/cveNotify/133190 · Telegram Post
• https://t.me/rnetsec/13077 · Telegram Post