PT-2022-9066 · Unknown · Zgr Tps200 Ng

Aarón Flecha Menéndez + 1 · Published 2022-10-17 · Updated 2023-11-20 · CVE-2020-8973

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions ZGR TPS200 NG version 2.00 firmware and 1.01 hardware

Description The issue allows an attacker with access to the network where the affected asset is located to operate and change several parameters without having to be registered as a user on the web that owns the device. This is due to the device not properly accepting specially constructed requests.

Recommendations For ZGR TPS200 NG version 2.00 firmware and 1.01 hardware, consider restricting access to the device's network to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit the ability to change parameters without proper user registration. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2020-8973

Affected Products

Zgr Tps200 Ng

References · 5

• https://osv.dev/vulnerability/CVE-2020-8973 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8973 · Security Note
• https://t.me/cibsecurity/51650 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-zgr-tps200-ng · Note
• https://t.me/cvenotify/60748 · Telegram Post