PT-2020-19820 · Ericsson Lg · Ipecs

Heehyun Kim · Published 2020-08-25 · Updated 2020-08-31 · CVE-2020-7824

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions iPECS (affected versions not specified)

Description The issue is related to insecure permission handling of session cookies in the web-based management interface. An authenticated, remote attacker could exploit this by modifying the cookie value, potentially gaining access to sensitive device information, including configuration files.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Default Permissions

Weakness Enumeration

CWE-267

CWE-276

Related Identifiers

CVE-2020-7824

Affected Products

Ipecs

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-7824 · Security Note
• https://osv.dev/vulnerability/CVE-2020-7824 · Vendor Advisory
• https://krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35572 · Note
• http://ericssonlg.co.kr · Note