CRITICAL🇵🇱 Wersja polska

CVE-2020-29056

CVSS 9.8v3.1pub. 2020-11-24upd. 2024-11-21

An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, FD1104B, FD1104S, FD1104SN, FD1108S, FD1204S-R2, FD1204SN, FD1204SN-R2, FD1208S-R2, FD1216S-R1, FD1608GS, FD1608SN, FD1616GS, FD1616SN, and FD8000 devices. One can escape from a shell and acquire root privileges by leveraging the TFTP download configuration.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Cdata Fd1104 Firmware

    OS
    Cdata
    2.4.03_000

  • Cdatatec 72408a

    HW
    Cdatatec
    all versions

  • Cdatatec 72408a Firmware

    OS
    Cdatatec
    1.2.22.4.03_0002.4.04_0012.4.05_000

  • Cdatatec 9008a

    HW
    Cdatatec
    all versions

  • Cdatatec 9008a Firmware

    OS
    Cdatatec
    1.2.22.4.03_0002.4.04_0012.4.05_000

  • Cdatatec 9016a

    HW
    Cdatatec
    all versions

  • Cdatatec 9016a Firmware

    OS
    Cdatatec
    1.2.22.4.03_0002.4.04_0012.4.05_000

  • Cdatatec 92408a

    HW
    Cdatatec
    all versions

  • Cdatatec 92408a Firmware

    OS
    Cdatatec
    1.2.22.4.03_0002.4.04_0012.4.05_000

  • Cdatatec 92416a

    HW
    Cdatatec
    all versions

  • Cdatatec 92416a Firmware

    OS
    Cdatatec
    1.2.22.4.03_0002.4.04_0012.4.05_000

  • Cdatatec 9288

    HW
    Cdatatec
    all versions

  • Cdatatec 9288 Firmware

    OS
    Cdatatec
    1.2.22.4.03_0002.4.04_0012.4.05_000

  • Cdatatec 97016

    HW
    Cdatatec
    all versions

  • Cdatatec 97016 Firmware

    OS
    Cdatatec
    1.2.22.4.03_0002.4.04_0012.4.05_000

  • Cdatatec 97024p

    HW
    Cdatatec
    all versions

  • Cdatatec 97024p Firmware

    OS
    Cdatatec
    1.2.22.4.03_0002.4.04_0012.4.05_000

  • Cdatatec 97028p

    HW
    Cdatatec
    all versions

  • Cdatatec 97028p Firmware

    OS
    Cdatatec
    1.2.22.4.03_0002.4.04_0012.4.05_000

  • Cdatatec 97042p

    HW
    Cdatatec
    all versions

  • Cdatatec 97042p Firmware

    OS
    Cdatatec
    1.2.22.4.03_0002.4.04_0012.4.05_000

  • Cdatatec 97084p

    HW
    Cdatatec
    all versions

  • Cdatatec 97084p Firmware

    OS
    Cdatatec
    1.2.22.4.03_0002.4.04_0012.4.05_000

  • Cdatatec 97168p

    HW
    Cdatatec
    all versions

  • Cdatatec 97168p Firmware

    OS
    Cdatatec
    1.2.22.4.03_0002.4.04_0012.4.05_000

  • Cdatatec Fd1002s

    HW
    Cdatatec
    all versions

  • Cdatatec Fd1002s Firmware

    OS
    Cdatatec
    1.2.22.4.03_0002.4.04_0012.4.05_000

  • Cdatatec Fd1104

    HW
    Cdatatec
    all versions

  • Cdatatec Fd1104b

    HW
    Cdatatec
    all versions

  • Cdatatec Fd1104b Firmware

    OS
    Cdatatec
    1.2.22.4.03_0002.4.04_0012.4.05_000
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Command Injection
CWE
References

Related vulnerabilities

CVE-2020-29054CRITICAL9.8PL ✓same product

CDATA OLT – ujawnienie poświadczeń TELNET w postaci jawnej

CVE-2020-29060CRITICAL9.8PL ✓same product

CDATA OLT — domyślne hasło konta debug (CWE-798)

CVE-2020-29061CRITICAL9.8PL ✓same product

CDATA OLT — domyślne hasło root w wielu modelach urządzeń sieciowych

CVE-2020-29062CRITICAL9.8PL ✓same product

CDATA OLT — domyślne puste hasło konta guest (CWE-798)

CVE-2020-29058CRITICAL9.8PL ✓same product

CDATA OLT — ujawnienie danych uwierzytelniających serwera WWW w postaci jawnej