PT-2021-12473 · Nec · Univerge Sv8500+1

Published 2021-01-13 · Updated 2021-01-21 · CVE-2020-5685

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: UNIVERGE SV9500 series from V1 to V7 UNIVERGE SV8500 series from S6 to S8

Description: The issue allows an attacker to execute arbitrary OS commands or cause a denial-of-service (DoS) condition by sending a specially crafted request to a specific URL.

Recommendations: For UNIVERGE SV9500 series from V1 to V7, restrict access to the specific URL to minimize the risk of exploitation. For UNIVERGE SV8500 series from S6 to S8, consider implementing additional security measures to prevent specially crafted requests from being processed. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2020-5685

Affected Products

Univerge Sv8500

Univerge Sv9500

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-5685 · Security Note
• https://necplatforms.co.jp/en/press/security_adv.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-5685 · Vendor Advisory
• https://jvn.jp/en/jp/JVN38784555/index.html · Note
• https://t.me/cvenotify/8829 · Telegram Post
• https://t.me/cvenotify/8465 · Telegram Post