PT-2020-5982 · Secomea · Secomea Gatemanager

Published 2020-07-29 · Updated 2020-09-02 · CVE-2020-14500

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Secomea GateManager versions prior to 9.2c

Description The issue is related to pointer dereference errors in the GateManager communication server. An attacker can exploit this by sending a negative value to overwrite arbitrary data, potentially allowing a remote attacker to impact the confidentiality, integrity, and availability of protected information.

Recommendations For Secomea GateManager versions prior to 9.2c, update to version 9.2c or later to resolve the issue. As a temporary workaround, consider restricting access to the GateManager server to minimize the risk of exploitation.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-158

CWE-476

Related Identifiers

BDU:2021-02294

CVE-2020-14500

Affected Products

Secomea Gatemanager

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2020-14500 · Security Note
• https://bdu.fstec.ru/vul/2021-02294 · Security Note
• https://osv.dev/vulnerability/CVE-2020-14500 · Vendor Advisory
• https://us-cert.cisa.gov/ics/advisories/icsa-20-210-01 · Note
• https://t.me/ckure/5043 · Telegram Post
• https://t.me/rnetsec/12965 · Telegram Post
• https://t.me/defcon_news/53230 · Telegram Post
• https://t.me/thehackernews/786 · Telegram Post
• https://us-cert.gov/ics/advisories/icsa-20-210-01 · Note
• https://t.me/secharvester/9602 · Telegram Post
• https://t.me/true_secator/802 · Telegram Post