PT-2022-9067 · Zgr · Zgr Tps200 Ng

The Industrial · Published 2022-10-17 · Updated 2023-11-09 · CVE-2020-8974

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions ZGR TPS200 NG version 2.00 (firmware) and version 1.01 (hardware)

Description The firmware upload process in the affected device does not have restrictions, allowing an attacker to modify the firmware and re-upload it via the web with malicious modifications. This can render the device unusable.

Recommendations For ZGR TPS200 NG version 2.00 (firmware) and version 1.01 (hardware), consider restricting access to the firmware upload process via the web to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2020-8974

Affected Products

Zgr Tps200 Ng

References · 4

• https://osv.dev/vulnerability/CVE-2020-8974 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8974 · Security Note
• https://t.me/cibsecurity/51653 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-zgr-tps200-ng · Note