PT-2023-11612 · Evertz · Evertz 3080Ipx+2

Linuxmonr4 · Published 2023-07-18 · Updated 2023-07-28 · CVE-2020-22159

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EVERTZ devices 3080IPX version exe-guest-v1.2-r26125 EVERTZ devices 7801FC version 1.3 Build 27 EVERTZ devices 7890IXG version V494

Description The issue allows an authenticated attacker to perform Arbitrary File Upload, enabling them to upload a webshell or overwrite critical system files.

Recommendations For EVERTZ devices 3080IPX version exe-guest-v1.2-r26125, consider restricting access to the file upload functionality until a patch is available. For EVERTZ devices 7801FC version 1.3 Build 27, restrict access to critical system files to minimize the risk of exploitation. For EVERTZ devices 7890IXG version V494, avoid using the vulnerable file upload feature until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2020-22159

Affected Products

Evertz 3080Ipx

Evertz 7801Fc

Evertz 7890Ixg

References · 5

• 🔥 https://cacharros-inthewild.blogspot.com/2023/07/the-3080ipx-is-integrated-multicast.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-22159 · Security Note
• https://osv.dev/vulnerability/CVE-2020-22159 · Vendor Advisory
• https://sku11army.blogspot.com/2020/02/evertz-path-transversal-arbitrary-file.html · Note
• https://t.me/cibsecurity/66940 · Telegram Post