PT-2021-9427 · Svakom · Svakom Siime Eye

Beau Du Jour · Published 2021-02-08 · Updated 2024-07-30 · CVE-2020-11920

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Svakom Siime Eye version 14.1.00000001.3.330.0.0.3.14

Description A command injection issue resides in the HOST/IP section of the NFS settings menu in the webserver running on the device. By injecting Bash commands via shell metacharacters, the device executes arbitrary code with root privileges, as all of the device's services are running as root.

Recommendations For Svakom Siime Eye version 14.1.00000001.3.330.0.0.3.14, consider disabling the webserver or restricting access to the NFS settings menu as a temporary workaround until a patch is available. Avoid using the HOST/IP section of the NFS settings menu until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2020-11920

Affected Products

Svakom Siime Eye

References · 6

• 🔥 https://pentestpartners.com/security-blog/vulnerable-wi-fi-dildo-camera-endoscope-yes-really · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-11920 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11920 · Vendor Advisory
• http://seclists.org/fulldisclosure/2024/Jul/14 · Note
• https://t.me/cvenotify/9557 · Telegram Post
• https://t.me/cibsecurity/23201 · Telegram Post