PT-2022-8982 · Sevone · Sevone Network Management System

Calvin Phang · Published 2022-06-03 · Updated 2022-06-14 · CVE-2020-36531

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SevOne Network Management System versions up to 5.7.2.22

Description A critical issue has been found in the Device Manager Page, where an injection leads to privilege escalation. The attack may be initiated remotely.

Recommendations For versions up to 5.7.2.22, consider restricting access to the Device Manager Page until a fix is available. As a temporary workaround, avoid using the Device Manager Page to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Special Elements Injection

RCE

Weakness Enumeration

CWE-74

CWE-1236

Related Identifiers

CVE-2020-36531

Affected Products

Sevone Network Management System

References · 5

• https://osv.dev/vulnerability/CVE-2020-36531 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36531 · Security Note
• https://vuldb.com/?id.162263 · Note
• https://t.me/cibsecurity/43940 · Telegram Post
• http://seclists.org/fulldisclosure/2020/Oct/5 · Note