PT-2020-20295 · Gurux · Gurux Gxdlms Director

Maciej Miszczyk · Published 2020-02-25 · Updated 2020-02-27 · CVE-2020-8809

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gurux GXDLMS Director versions prior to 8.5.1905.1301

Description The issue allows a man-in-the-middle attacker to modify the contents of gurux.fi/obis/files.xml and gurux.fi/updates/updates.xml, prompting the user to download updates over an unencrypted HTTP connection. This can lead to code execution, either directly through add-ins if used, or through OBIS codes, which are necessary for communication with energy meters.

Recommendations For versions prior to 8.5.1905.1301, update to version 8.5.1905.1301 or later to resolve the issue. As a temporary workaround, consider restricting access to the gurux.fi/obis/files.xml and gurux.fi/updates/updates.xml files to minimize the risk of exploitation. Avoid using unencrypted HTTP connections for downloading updates until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-494

Related Identifiers

CVE-2020-8809

Affected Products

Gurux Gxdlms Director

References · 6

• 🔥 https://github.com/seqred-s-a/gxdlmsdirector-cve · Exploit
• 🔥 https://seqred.pl/en/cve-gurux-gxdlms-director · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-8809 · Security Note
• https://osv.dev/vulnerability/CVE-2020-8809 · Vendor Advisory
• https://t.me/cvenotify/1230 · Telegram Post
• https://t.me/cvenotify/1229 · Telegram Post