PT-2020-20449 · Symmetricom · Syncserver S300+4

Published 2020-02-17 · Updated 2021-07-21 · CVE-2020-9034

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Symmetricom SyncServer S100 version 2.90.70.3 Symmetricom SyncServer S200 version 1.30 Symmetricom SyncServer S250 version 1.25 Symmetricom SyncServer S300 version 2.65.0 Symmetricom SyncServer S350 version 2.80.1

Description The issue is related to the mishandling of session validation, which can lead to unauthenticated creation, modification, or elimination of users.

Recommendations For Symmetricom SyncServer S100 version 2.90.70.3, update to a version that properly handles session validation. For Symmetricom SyncServer S200 version 1.30, update to a version that properly handles session validation. For Symmetricom SyncServer S250 version 1.25, update to a version that properly handles session validation. For Symmetricom SyncServer S300 version 2.65.0, update to a version that properly handles session validation. For Symmetricom SyncServer S350 version 2.80.1, update to a version that properly handles session validation. As a temporary workaround, consider restricting access to user management functions until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2020-9034

Affected Products

Syncserver S100

Syncserver S200

Syncserver S250

Syncserver S300

Syncserver S350

References · 4

• 🔥 https://sku11army.blogspot.com/2020/01/symmetricom-syncserver_27.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-9034 · Security Note
• https://osv.dev/vulnerability/CVE-2020-9034 · Vendor Advisory
• https://t.me/cvenotify/1059 · Telegram Post