PT-2025-1296 · Unknown · Stealthone D220/D340

Chuya Hayakawa + 1 · Published 2025-01-06 · Updated 2025-01-14 · CVE-2025-20620

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions STEALTHONE D220/D340 versions up to 6.03.02

Description A SQL Injection vulnerability exists in the STEALTHONE D220/D340, allowing an attacker who can access the affected product to obtain the administrative password of the web management page. This issue is related to the lack of protection measures for the SQL query structure, which can be exploited by a remote attacker to gain unauthorized access to protected information.

Recommendations For STEALTHONE D220/D340 versions up to 6.03.02, consider disabling access to the web management page until a patch is available. Restrict access to the administrative password to minimize the risk of exploitation. Avoid using the web management page for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2025-00768

CVE-2025-20620

Affected Products

Stealthone D220/D340

References · 8

• https://bdu.fstec.ru/vul/2025-00768 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-20620 · Security Note
• https://t.me/cvenotify/107290 · Telegram Post
• https://jvn.jp/en/vu/JVNVU99653331 · Note
• https://twitter.com/WolfgangSesin/status/1879125618438078477 · Twitter Post
• https://twitter.com/CVEnew/status/1879103733315010875 · Twitter Post
• https://t.me/cvedetector/15243 · Telegram Post
• https://stealthone.net/product_info/d220-d340%e3%80%8cv6-03-03%e3%80%8d%e5%8f%8a%e3%81%b3d440%e3%80%8cv7-00-11%e3%80%8d%e3%83%95%e3%82%a1%e3%83%bc%e3%83%a0%e3%82%a6%e3%82%a7%e3%82%a2%e3%82%92%e3%83%aa%e3%83%aa%e3%83%bc%e3%82%b9%e8%87%b4 · Note